F5: Threshold Alert Flow — Act Now

## Summary
Triggered by monitoring/probing (e.g. storage at 90%). Sends a warning email with a manual "Act Now" CTA; clicking hands off to Brain to guide or execute the fix — still user-initiated.

## Acceptance Criteria
- [ ] Threshold-based triggers from probing engine (storage, resource limits)
- [ ] Warning email with manual "Act Now" call to action
- [ ] Clicking CTA hands off to Brain for guided fix
- [ ] Every action requires explicit user click (no autonomous execution)
- [ ] Scheduled inspection ("patrol"): nightly sweep, AI investigates only on anomaly

## Sprint Assignment
- Sprint 5: Ships as primary release

## Constraints
- Launch: AI recommends but never executes autonomously
- Post-launch: narrow, verified, non-high-risk stateless ops (e.g. container restart) progressively enabled
- NEVER: any operation touching data or persistent volumes — permanently excluded

## Success Metrics
- Alert-to-resolution time
- Recommendation acceptance rate

No files or tests are named. Start by locating the probing engine, patrol scheduler, warning-email flow, and Brain handoff entry points; verify the acceptance criteria, especially explicit user clicks and the exclusion of data or persistent-volume operations.

Written by the indexing model from the issue text.