Run an investigation
Triggers POST /investigate. The agent connects over SSH (read-only)
and writes an incident report under ./incidents/.
Expect the call to take roughly 20–60 seconds depending on the prompt.
Live activity stream: connecting…
Events stream from GET /events (Server-Sent Events).
Prompt and response content is never streamed—only timing and counts.