[IXI-2773]

Summary

• Preserve Splunk native scheduled-search job results and tracked-alert firing before temporary schedule cleanup; keep credentials and private logs out of Git.
• Add source-bound November 8 standalone lab confirmation: 64 canonical + 6 replayed synthetic authentication events, five original findings, and one native scheduled alert firing (result and tracked alert). The temporary schedule was disabled and unscheduled; external actions stayed off.
• Publish honest interview-facing SOC case study, evidence limitations, and links in the project index.

Scope and verification

• Synthetic, owner-operated lab only, not a production incident, customer data or production SOC deployment.
• 22 focused offline verifier tests previously passed. One bounded live native CLI confirmation already recorded; do not rerun the live Splunk instance or an unrelated full suite.
• Please run normal PR-required checks once. Do not bypass repository protections or force merge.
• The independent token-based verifier entrypoint and bundled custom dashboard/app remain unverified live; genuine screenshots remain outstanding.

Expected outcome

If required PR checks pass, merge this branch into main so the proof can be linked permanently from the portfolio.