feat(observability): automated alert first-pass triage Lambda

**Context:** ROADMAP.md → Automated alert first-pass triage

---

## Component

API or orchestration

## Describe the feature

On selected **security/ops alarms**, a Lambda produces a **structured disposition** from logs, traces, and `TaskEvents` before human review. Distinct from post-mortem **LLM-assisted trace analysis** on failed tasks.

## Use case

On-call receives raw alarms with little context. First-pass triage narrows scope: likely false positive, known flake, or escalate with linked task_ids.

## Proposed solution

1. SNS subscription from security/ops alarms → TriageFn.
2. Structured output: `disposition`, `confidence`, `linked_task_ids`, `recommended_action`.
3. Post to Slack ops channel or ticket system.
4. Cost/rate limits; no PII in outbound summaries.
5. Human override feedback loop for tuning.

## Other information

- Distinct from llm-assisted-trace-analysis draft (task-scoped post-mortem).
- Design context: `docs/design/OBSERVABILITY.md`.

- [ ] This might be a breaking change

ROADMAP.md の自動アラート初回トリアージのエントリから始め、既存の observability 設計について docs/design/OBSERVABILITY.md を読んでください。設計上の境界、必要なアラーム入力と構造化出力、配信先、安全上の制限、フィードバックループを明確にしてください。提案が実装に十分な粒度で仕様化されていれば完了です。

索引モデルが issue の本文から書いたものです。