Harden the opt-in continuous incident probe for production use

[deucebucket]

Current prototype

This branch adds an opt-in journal follower with in-process signature matching, bounded private event captures, cooldowns, rotation, resource limits, and ingestion into a normal DeckDoc report.

Remaining scope

Prove that the watcher is negligible during real play and resilient across suspend, journal rotation, storage pressure, service restart, and SteamOS update behavior.

Acceptance criteria

• Measure idle CPU, wakeups, RSS, journal bandwidth, and storage growth on LCD and OLED Decks.
• Capture trigger, pre/post journal, boot ID, memory/PSI, thermal/fan, power, DRM, network, USB/dock, storage, session, and core metadata without remediation.
• Deduplicate bursts without losing the first and last relevant event.
• Enforce documented byte/event/age retention limits and safe low-space behavior.
• Preserve private permissions and provide a redaction/export workflow.
• Survive suspend/resume and service restart without duplicate followers.
• Expose status, last event, missed/inaccessible sources, install, uninstall, and separate purge.
• Add real fixtures for GPU reset, SOF, Wi-Fi resume, OOM, storage I/O, dock reset, thermal, and Gamescope restart.

Safety boundary

The service must not reload drivers, reset hardware, change clocks/power/display state, upload data, or enable itself during normal setup.

Docs

docs/wiki/Continuous-Incident-Probe.md