Runbook: Incident Response

1. Claim next INCIDENT number from INDEX.md
2. Create /root/.openclaw/workspace/docs/INCIDENT-NNN.md
3. Identify scope and severity (Type 1-5)
4. Fix the immediate issue
5. Write post-mortem
6. Update CLAUDE.md security rules if needed
7. Send Telegram alert: /usr/local/bin/tg-alert.sh "INCIDENT-NNN: summary"