Runbook: Incident Response State
Focus: State-Leak, Credential-Rotation und Recovery

1. Run ./run.sh.
2. Inspect work/evidence/.
3. Review HCL, provider requirements and state assumptions.
4. Remove work/ after collecting evidence.
