[x] Temporary artifacts cleaned deterministically; filesystem targets validated in tests.
[x] Timeline publisher emits bundle sealed and hold events with DSSE metadata when enabled; offline deployments fall back to null publisher.
[x] Bundle packaging outputs deterministic bundle.tgz (fixed gzip mtime, sorted checksums, timestamp-aware instructions) and /evidence/{id}/download streams the cached object with audit logging.
[x] Incident mode extends bundle retention, captures incident request snapshots, and emits activation/deactivation events to Timeline Indexer and Notifier stubs with unit + web integration coverage.
[x] Portable bundle flow (/evidence/{id}/portable) emits portable-bundle-v1.tgz with redacted metadata, deterministic offline script, and write-once storage tracking.
