Adds Step 2.4: when a session root-causes a real incident and the
project's planning store supports an incident type + rca-<date>-<slug>.md
convention, write the postmortem there via cp-cli and link affected
items via impacted/impacted_by. Skips cleanly for projects without
that convention. Adds a scoped cp_cli Bash allowlist entry.
Session isn't finished until delivered work is written back to the project's
canonical planning store (cp-cli / local checkout / offline staging), and
roll-up docs are checked for contradictions. Motivated by the agent-runtimes
work-items repo drifting 6 weeks behind delivered reality.
