Complete local research platform and deployment workflows

[zhadyz]

The default branch still contains the earlier research prototype with permissive CI, non-durable workflows, and simulated response success. Merge the completed research-platform branch into master so the default checkout contains the current implementation and documented acceptance evidence.

This adds durable triage and response recovery, identity and independent review workflows, evidence-based response verification, the disposable Wazuh enforcement lab, consistent container deployment, stricter tests and CI, and updated operating documentation.

Pre-merge verification found that the advisory feed now reports three already-reviewed Chroma CVEs under PYSEC IDs. The audit now matches advisory aliases as well as primary IDs, retaining exact package/version and expiry restrictions. Six regression cases cover recognized IDs, aliases, unreviewed advisories, version mismatches, and expired exceptions. No dependency exceptions were added or extended. CI also refreshes its Python packaging tools and retains dependency audit diagnostics.

Validation on the final branch commit:

• Python 3.11 offline suite on macOS and GitHub Linux: 199 passed, 1 explicit live-only test skipped.
• Python compilation, fatal-error Ruff checks, Compose configuration, and whitespace checks passed.
• GitHub dependency audit: 133 packages scanned, zero unresolved findings under the existing documented mitigation policy.
• All ten application/maintenance images and the lab target built successfully.
• All 12 GitHub Actions jobs passed: https://github.com/zhadyz/AI_SOC/actions/runs/35560994324

The branch includes earlier native/container/browser/lab acceptance reports; those are historical evidence, not a new live acceptance run for this merge. Production vendor integration and external research validation remain documented limitations.