feat: Implement agent-pd-ir (Incident Response agent)

[dcplatforms]

Overview

Implement agent-pd-ir — the Incident Response agent. Manages the full IR lifecycle: Detection → Analysis → Containment → Eradication → Recovery → PIR.

Spec: specs/personas/pd-ir.yaml
System prompt: prompts/pd-ir/system.md (already written)
Memory template: prompts/pd-ir/memory_inject.md (already written)

Implementation

• AgentPDIR class in src/agents/pd_ir/
• All T3 tools as async methods
• T2 action proposals (no execution) for isolation/blocking recommendations
• T1 advisory output only for network quarantine / legal hold
• Full memory integration (episodic write, semantic read: threat_intel, incident_history, mitre_attack)
• Implement output_schema.json for structured JSON output validation

Dependencies

• Depends on Issue feat: Implement agent-pd-defensive (reference agent implementation) #3 (agent-pd-defensive reference pattern)
• Depends on MemoryManager being implemented