Agentic investigator

The agent gets only the alert — not the full incident dump. It calls read-only tools (get_metrics, get_logs, get_deploy_history, search_runbooks) in a hand-written loop to discover the evidence, then writes the structured response. Every step is shown below.