feat(reporting): ✨ Navigate findings to supporting evidence

[PrzemyslawKlys]

Investigation findings now open their supporting captured log record or identity artifact in the report. A link can reveal a filtered record on a later page and move keyboard focus to its details. Evidence coordinates remain visible, while raw log messages and identity fields remain excluded by default and available through explicit opt-in.

Repeated captures of identical DSRegCmd bytes share one artifact target. Its details retain each capture context and time together, so readers can distinguish SYSTEM and user captures without losing their associations. Missing evidence remains a plain coordinate, and incomplete coverage remains explicit.

The report uses the public HtmlForgeX package's reusable DetailRecordLink interaction. HtmlForgeX owns selection, deferred-record lookup and drawer focus; EventViewerX supplies investigation records and their evidence relationships. The consumer pins the published HtmlForgeX 1.4.0 package, embeds report assets for offline use, and adds no production dependency. Regular and archive dependency locks retain SDK package evidence and refreshed restore-package hashes verified by PowerForge.

The roadmap keeps supplemental logs, captured facts, evidence-backed findings, replay, privacy and reporting within investigations. Additional offline parsers or diagnostic packs require representative captures and a concrete investigation use case. Graph, AI adapters and fleet or desktop products retain their separate ownership and product decisions.

This change extends the captured-investigation workflow introduced in #150 and contextual diagnostic explanations in #152, both merged into master. The native EVTX archive correction in #151 is also merged.

Validation: 70 focused cases pass on each of .NET 8 and 10, including saved diagnostic interpretation, evidence routing and capture-context/time associations. The generated report was exercised with standard and minified assets in light/dark themes at wide, compact and landscape viewports, including keyboard navigation, privacy opt-in and empty evidence. One independent review and a targeted confirmation covered the owner and consumer contracts. The public-package candidate also passes actual CLI capture/inspection/replay and report export, plus unsigned module capture/reopening/replay and report export on PowerShell 5.1 and 7.6.6. Qualification uses repository fixture forms and documented examples; it does not establish live deployment coverage.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T21:03:20.991939Z	b777290	New commits
🔒 Security Review	✅ Completed 2026-10-09T19:26:11.917865Z	db08dd8	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: db08dd88bb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".