Prepare an incident handoff

Where: triage → incidents → investigate → export investigation. This is read-only cluster access and creates a local Markdown file or clipboard copy; nothing is uploaded automatically.

1. Verify captured context, namespace, resource name and Pod UID.
2. Review UID-correlated events and current owner snapshots. Name-only events are unverified and excluded.
3. Select a container and current/previous mode, then choose capture bounded logs. Capture is finite and identity-checked before and after the read.
4. Edit the redacted preview or clear include edited excerpt in export.
5. Open export, reread all evidence and limitations, then copy or download Markdown.

Log evidence is capped and may be truncated or unavailable. Current/previous selection does not prove an exact runtime container instance. Redaction is best effort; review before sharing.

Source: src/components/TriageInvestigation.tsx, src/lib/logEvidence.ts, src/lib/incidentReport.ts, src-tauri/src/k8s/logs.rs at v0.18.0.