Investigations

Scan history with a chain of custody.

Every run is pinned to a repository revision, scoped by a threat model, and retained as a read-only investigation record.