Incident Timeline Audit

Derive incident durations from a timeline and report what makes them unreliable. The finding that matters: a phase recorded before the phase that must precede it, which means a time was backfilled, so every duration derived from the pair is fiction. Also reports a time with no UTC offset, which during an incident means somebody wrote their own zone; a missing phase, so a duration cannot be derived; an unrecorded gap of an hour or more; and a derived duration beyond a target the caller states.