Add public ingress incident records

[cbusillo]

Summary

• add typed public-ingress incident records and storage support
• reconcile monitor observations into open/resolved incidents
• expose open incident state in product environment public-ingress summaries
• document observations vs incidents as separate record families

Validation

• uv run python -m unittest tests.test_public_ingress_monitor tests.test_filesystem_store tests.test_product_environment_read_model
• uv run --extra dev ruff check control_plane/contracts/public_ingress_monitoring.py control_plane/contracts/product_environment_read_model.py control_plane/storage/filesystem.py control_plane/storage/postgres.py control_plane/storage/migrations/versions/e5f7a9b1c3d5_add_public_ingress_incidents.py control_plane/workflows/public_ingress_monitor.py tests/test_public_ingress_monitor.py tests/test_filesystem_store.py tests/test_product_environment_read_model.py
• uv run --extra dev mypy control_plane/contracts/public_ingress_monitoring.py control_plane/contracts/product_environment_read_model.py control_plane/storage/filesystem.py control_plane/storage/postgres.py control_plane/workflows/public_ingress_monitor.py tests/test_public_ingress_monitor.py tests/test_filesystem_store.py tests/test_product_environment_read_model.py
• uv run alembic heads

Refs #981
Refs #929