Make incidents discoverable and operator-ready

[CodeBuildder]

Closes #69
Closes #71

What changed

• adds a prominent live-count OPEN INCIDENTS control beside the Operations Evidence record count
• opens the existing correlated-incident explorer directly from the evidence table
• keeps the control readable, keyboard accessible, and responsive
• carries the already-reviewed Phase 15 How it works commits onto current main; the earlier stacked PR was merged into its feature base after that base had already merged, so those commits did not reach main
• rewrites the explainer around proactive detection and resilience: Argus contains threats near admission/kernel/runtime/network enforcement, while Phoenix tests bounded failures before customers encounter them
• makes the layered-defense USP explicit on screen: admission → kernel/runtime → L3/L4/L7 network enforcement → service resilience, coordinated by Sentinel and the SOG
• derives an operator-ready report for every Argus + Phoenix correlation, including executive summary, detection, affected resource, impact, root cause, decision, governance, recovery, verification, next action, and evidence source
• renders the report above the seven-stage proof timeline without inventing unavailable facts

Why

The evidence table is the natural investigation and recording surface, but users had no visible path from evidence records to correlated incident lifecycles. The only entry point was a metric tile much higher on the page, making the seven-stage proof difficult to discover.

User impact

From the Operations Evidence screen, users can now select OPEN INCIDENTS, choose a correlated case, and read a complete operator report before inspecting its resilience proof timeline. Seeded and dynamically generated correlations use the same report contract.

Validation

• npm run build
• .venv/bin/python -m pytest backend/tests/test_main.py -q — 8 passed
• git diff --check
• running Vite server hot-reloaded the new incident-entry control