Add AWS incident triage agent + CloudWatch investigation skill

[starlightretailceo]

Summary

• Agent (aws-incident-triage.agent.md): On-call SRE persona with 6-phase investigation protocol — alarms → blast radius → metrics → logs → traces → root-cause hypothesis with evidence citations.
• Skill (skills/aws-cloudwatch-investigation/SKILL.md): 5 reusable patterns — Logs Insights query templates (errors, p99, cold starts, OOM), alarm-to-deploy correlation, blast-radius decision tree, PromQL-style metric queries, incident timeline reconstruction.

Motivation

Existing AWS agents in this repo focus on architecture and planning. None wire up the multi-signal investigation loop that on-call engineers actually need during incidents — fusing alarms, metrics, logs, and traces into a structured triage flow.

Test plan

• Validate frontmatter matches .schemas/ if schema validation is configured
• Invoke agent in VS Code Copilot Chat to confirm persona activates
• Test skill queries against a real CloudWatch log group

🤖 Generated with Claude Code

[github-actions]

⚠️ This PR targets main, but PRs should target staged.

The main branch is auto-published from staged and should not receive direct PRs.
Please close this PR and re-open it against the staged branch.

You can change the base branch using the Edit button at the top of this PR,
or run: gh pr edit 2071 --base staged

[github-actions]

✅ Base branch is now set correctly.

Removing the prior block because this PR no longer targets main.

[github-actions]

✅ External plugin PR checks passed

• Changed entries detected: 0
• Workflow state label: ready-for-review

Per-plugin quality summary

Plugin	skill-validator	install smoke test	overall	source tree
none	not_run	not_run	not_run	n/a

No changed external plugin entries were detected in this PR.

[github-actions]

🔍 Skill Validator Results

⛔ Findings need attention

Scope	Checked
Skills	1
Agents	1
Total	2

Severity	Count
❌ Errors	4
⚠️ Warnings	1
ℹ️ Advisories	0

Summary

Level	Finding
❌	[AWS CloudWatch Investigation] Skill name 'AWS CloudWatch Investigation' contains invalid characters — must be lowercase alphanumeric and hyphens only.
❌	[AWS CloudWatch Investigation] Skill name 'AWS CloudWatch Investigation' does not match directory name 'aws-cloudwatch-investigation'.
❌	[agent:AWS Incident Triage] Agent name 'AWS Incident Triage' does not match filename 'aws-incident-triage.agent.md' (expected 'AWS Incident Triage.agent.md').
❌	[agent:AWS Incident Triage] Agent name 'AWS Incident Triage' contains invalid characters — must be lowercase alphanumeric and hyphens only.

Full validator output

Found 1 skill(s)
[AWS CloudWatch Investigation] 📊 AWS CloudWatch Investigation: 2,667 BPE tokens [chars/4: 2,633] (standard ~), 21 sections, 15 code blocks
❌ [AWS CloudWatch Investigation] Skill name 'AWS CloudWatch Investigation' contains invalid characters — must be lowercase alphanumeric and hyphens only.
❌ [AWS CloudWatch Investigation] Skill name 'AWS CloudWatch Investigation' does not match directory name 'aws-cloudwatch-investigation'.
[AWS CloudWatch Investigation]    ⚠  Skill is 2,667 BPE tokens (chars/4 estimate: 2,633) — approaching "comprehensive" range where gains diminish.
Skill spec conformance failures — fix the errors above.
Found 1 agent(s)
❌ [agent:AWS Incident Triage] Agent name 'AWS Incident Triage' does not match filename 'aws-incident-triage.agent.md' (expected 'AWS Incident Triage.agent.md').
❌ [agent:AWS Incident Triage] Agent name 'AWS Incident Triage' contains invalid characters — must be lowercase alphanumeric and hyphens only.
Validated 1 agent(s)
Agent spec conformance failures — fix the errors above.

Note: The validator returned a non-zero exit code. Please review the findings above before merge.

[github-actions]

🔒 PR Risk Scan Results

Scanned 4 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	3
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	docs/README.skills.md	31	| [acreadiness-assess](../skills/acreadiness-assess/SKILL.md)<br />`gh skills install github/awesome-copilot acreadiness-assess` | Run the AgentRC readiness assessment on the curre
🟠	unpinned-version-indicator	skills/aws-cloudwatch-investigation/SKILL.md	90	| filter @​​message like /Task timed out/ or @​​duration > 28000
🟠	unpinned-version-indicator	skills/aws-cloudwatch-investigation/SKILL.md	242	Label: "Latency vs Baseline (ratio > 2 = anomaly)"

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.