feat: add SRE production incident response demo

[devin-ai-integration]

Summary

Adds demos/observability-sre/incident-response-demo.md — the first demo in the catalog where Devin operates against a running system and reacts to a production signal rather than to a human typing. Closes the SRE / on-call job-function gap (demos/ previously covered only data engineering, security, migration, and app development).

Anchor repo is otterworks, and the thread runs on wiring that already exists on its main rather than on invented paths:

Prometheus scrape (15s)
  -> Grafana rule NotificationConsumerProcessingErrors
     observability/grafana/provisioning/alerting/alert-rules.yml
  -> webhook otterworks-webhook-receiver (Bearer $ALERT_WEBHOOK_SECRET)
     -> POST admin-service:8089 /api/v1/admin/alerts/ingest
  -> AlertsController#ingest -> Incident (dedup) -> DevinSessionService
  -> Devin v3 API session, prompt carries the alert payload

The technical spine is a genuine cross-language root cause, not a staged one. The symptom is a Kotlin deserialization failure in SqsConsumer.parseMessage; the payload that breaks it is emitted by the Ruby ChaosProbeService with an integer epoch timestamp where SqsNotificationMessage.timestamp is a String, and the same investigation surfaces a second latent drift where the Rust FileEvent in services/file-service/src/events.rs emits folderId/name/mimeType/sizeBytes that the Kotlin model never declares — tolerated only because the normal parser sets ignoreUnknownKeys = true. search-service's Python _normalize_event already branches over both payload shapes, which is the corroborating evidence that the contract has drifted.

Parts 1–8: alert fires and the session opens itself → reproduce on the local stack (make infra-up, make up seed=1) → cross-boundary root cause → child-session fan-out producing docs/EVENT_CONTRACTS.md → fix PR with regression tests in SqsConsumerTest.kt and a serialization assertion in events.rs (gate: ./gradlew test + cargo test) → Devin Review on a human's producer-side PR and the loop closing on Devin's own PR → postmortem → repo-scoped Knowledge note. Artifacts the repo does not have yet (docs/postmortems/, docs/EVENT_CONTRACTS.md) are created by the demo; the runbook step completes the real unfinished Resolution Steps / Post-Incident sections of docs/runbooks/notification-processing-failure.md.

Includes a "What Still Needs a Human" section that is explicit about production access boundaries (Devin reads signals and writes code/docs; mitigation, merge, deploy, severity classification, and comms stay human).

Index updates so counts stay accurate:

• catalog/field-kit-offerings.md: demos 11 (3 categories) → 15 (5 categories), and the prose category list now includes application-development and observability-sre. Count excludes supporting material (demos/security/general*.md, demos/migration/scenarios/).
• catalog/repos.md: otterworks Challenges row links the new demo.

No labs/**/README.md currently links into demos/, so no link was added there rather than inventing a convention.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/ee92439833c34689960da75205836f64

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring