Build Week: Correlate cross-agent incident lifecycle

[CodeBuildder]

Summary

Turns explicitly related Argus and Phoenix findings into one inspectable Sentinel incident lifecycle while keeping standalone evidence out of incident counts.

Why

Sentinel previously displayed SOG findings and SOG incidents side by side without enforcing a correlation contract. This allowed a Phoenix evidence count to look like a Phoenix incident even when no scenario-backed incident existed.

Correlation rules

Sentinel creates a derived correlated case only when:

1. evidence carries a non-empty explicit correlation_id; and
2. that same ID is present on both Argus and Phoenix evidence.

Time proximity, matching severity, and similar resource names never fabricate a relationship.

Changes

• normalizes observed, replayed, simulator, and live Chaos Mesh provenance
• groups explicit cross-agent evidence into ordered cases
• excludes standalone findings from incident counts
• preserves existing SOG incidents without duplicating correlation IDs
• exposes case status, severity, sources, evidence count, provenance, and timeline
• makes incident rows inspectable
• adds an evidence-to-recovery drawer with lifecycle stage, source, action, outcome, and provenance
• adds a regression test proving single-source evidence does not become an incident

Verification

• Sentinel backend: 5 passed
• TypeScript compilation and Vite production build: passed
• git diff --check passed

Live producer proof

The actual Argus and Phoenix World Model clients published two explicitly non-live records with correlation ID build-week-case-20260718. Sentinel produced exactly one case:

• status: resolved
• severity: critical
• sources: argus, phoenix
• evidence: 2
• provenance: replayed, simulator

This proves cross-agent correlation without presenting deterministic demo evidence as observed production telemetry.

Dependencies

• Stacked on Build Week: Unified OpenAI Sentinel command center #51 because the lifecycle UI uses the unified command-center drawers.
• Argus producer: Build Week: Preserve SOG correlation IDs in Argus argus-k8s#109
• Phoenix producer: Build Week: Correlate Phoenix healing lifecycle evidence phoenix#64

After #51 merges, this PR should be retargeted to main.

Closes #52