Adds Step 2.4: when a session root-causes a real incident and the
project's planning store supports an incident type + rca-<date>-<slug>.md
convention, write the postmortem there via cp-cli and link affected
items via impacted/impacted_by. Skips cleanly for projects without
that convention. Adds a scoped cp_cli Bash allowlist entry.
1b62c256f6