Incident debugging runbook skill: evidence first, read-only

During an incident, the risk is jumping to a fix before understanding the failure. This skill puts Claude Code into a structured, read-only investigation mode that works from the code repository and whatever evidence you paste in (error messages, stack traces, log excerpts, metrics descriptions).

**How it works** 1. **Frame**: captures the symptom, when it started, who is affected, and what "resolved" means. 2. **Changes**: lists deploys and merges near the start time using `git log` and tags, and diffs the most likely suspects. 3. **Trace**: follows the stack trace or error string into the code to find where it is raised and what conditions trigger it. 4. **Hypotheses**: ranks two to five explanations by how well they fit the evidence, and for each gives a check that would confirm or rule it out. 5. **Mitigate**: separates mitigation (rollback, feature flag off, scale up) from root-cause fix, and recommends the least risky mitigation. 6. **Log**: keeps a timestamped incident log in `incidents/<date>-<slug>.md` that becomes the first draft of the postmortem.

**Safety rules** The skill is read-only by default. It does not run commands against production systems, restart services, run migrations, or change infrastructure. When a check needs production access, it writes the exact command for you to run and asks you to paste the output.

**What it will not do** It does not assign blame, guess at causes it cannot connect to evidence, or write the final postmortem. When evidence is thin, it says what data would help most.