Adds Step 2.4: when a session root-causes a real incident and the project's planning store supports an incident type + rca-<date>-<slug>.md convention, write the postmortem there via cp-cli and link affected items via impacted/impacted_by. Skips cleanly for projects without that convention. Adds a scoped cp_cli Bash allowlist entry.