A ransomware isolation workflow snapshots the volumes correctly, but the snapshot retention tag is missing and cleanup automation deletes the evidence before triage starts

Containment worked, yet incident preservation failed because the evidence path lacked lifecycle protection.