feat(observability): automated alert first-pass triage Lambda

**Context:** ROADMAP.md → Automated alert first-pass triage

---

## Component

API or orchestration

## Describe the feature

On selected **security/ops alarms**, a Lambda produces a **structured disposition** from logs, traces, and `TaskEvents` before human review. Distinct from post-mortem **LLM-assisted trace analysis** on failed tasks.

## Use case

On-call receives raw alarms with little context. First-pass triage narrows scope: likely false positive, known flake, or escalate with linked task_ids.

## Proposed solution

1. SNS subscription from security/ops alarms → TriageFn.
2. Structured output: `disposition`, `confidence`, `linked_task_ids`, `recommended_action`.
3. Post to Slack ops channel or ticket system.
4. Cost/rate limits; no PII in outbound summaries.
5. Human override feedback loop for tuning.

## Other information

- Distinct from llm-assisted-trace-analysis draft (task-scoped post-mortem).
- Design context: `docs/design/OBSERVABILITY.md`.

- [ ] This might be a breaking change

Start with the automated alert first-pass triage entry in ROADMAP.md and read docs/design/OBSERVABILITY.md for the existing observability design. Clarify the design boundaries, required alarm inputs and structured outputs, delivery targets, safety limits, and feedback loop; done means the proposal is sufficiently specified for implementation.

Written by the indexing model from the issue text.