Feature: Incident timeline workbench across events, audit, metrics, and agent steps

## Summary
Add an incident timeline workbench that correlates platform events, audit records, SLO/drift signals, gate decisions, deployment changes, and agent steps into a single investigation view.

## Problem / Opportunity
AegisVision has strong observability, audit logs, runbooks, and console pages, but incident responders still need to pivot between multiple surfaces during an outage or model-quality incident. A dedicated workbench would reduce time-to-understanding and produce a durable incident record for follow-up and compliance evidence.

## Proposed Feature
Create an incident resource and timeline builder that can pull correlated records by tenant, stream, pipeline, model, trace ID, time window, and incident tags. The console should support bookmarking important records, adding responder notes, exporting a signed incident package, and linking to relevant runbooks.

## Scope
- Define incident resources, timeline entries, notes, tags, and status transitions.
- Add correlation queries over event-service, audit-service, SLO, drift, canary/shadow, and agent-step records.
- Add console workbench for filtering, pinning, annotating, and exporting timelines.
- Add signed export suitable for postmortems and audit evidence.
- Add docs and runbook updates for using the workbench during incidents.
- Ensure all incident actions are themselves audited.

## Acceptance Criteria
- [ ] A responder can create an incident for a tenant/time window and populate a correlated timeline.
- [ ] Timeline entries preserve source references and link back to authoritative records.
- [ ] Responders can pin entries, add notes, assign severity, and change incident status.
- [ ] The workbench can export a signed incident timeline package.
- [ ] Agent/tool actions related to the incident are included with citations and gate status.
- [ ] Documentation explains retention, permissions, and postmortem workflow.

## Non-Goals
- Replacing Grafana, Tempo, Loki, or the existing runbooks.
- Implementing full on-call scheduling or paging.
- Allowing edits to authoritative audit records.

## Dependencies / Risks
- Correlation must avoid copying sensitive data into a less-protected store.
- Large incidents may require pagination and incremental loading.
- Export permissions need careful tenant and role scoping.

## Open Questions
- Should incident records live in audit-service, event-service, or a dedicated incident-service?
- Should incident creation be automatic from certain SLO or drift alerts?