Incident response snapshot leaks secrets through copied temp files

A manual triage procedure preserves evidence, but the copied bundle accidentally includes secret-bearing temp artifacts.