Add EC2 source-code discovery and reliability triage

Second discovery pass over the Scrivas EC2 estate (716468089330, us-east-2,
7 instances), prompted by the client reporting reliability issues and by their
lack of access to source code held under contract by the incumbent vendor.

Source code recovery
- All 10 application repositories exist as complete git checkouts on
  Scrivas-owned instances, with full history rather than deployed artifacts:
  4 app repos on Scrivas_dev_env, 6 ML repos on ML_dev.
- Every remote points at git@git.devteam.space (the contractor's self-hosted
  GitLab), which Scrivas does not control. The on-instance checkouts are the
  client's only independent leverage over their own source.
- Gap: both /var/www frontends are build output with no .git, so frontend
  source is not recoverable from EC2.
- Time-sensitive: scrivas_backend received a commit on the assessment date.

Reliability triage
- Production runs 23 containers on a single 15 GiB host, including 3 Postgres
  instances, Kafka and OpenSearch, at 73% memory at rest with no per-container
  memory limits and no swap on any of the 7 instances.
- Kafka, OpenSearch and search-api carry restart policy `no`, so a host reboot
  yields a partially-recovered stack.
- Recorded as a structural exposure, not an observed root cause: no OOM event
  is present in retained logs and RestartCount is 0 on every prod container.
  Confirming the hypothesis needs CloudWatch history the boxes do not retain.

Contents
- scripts/ec2_code_discovery.py  EC2 inventory (describe + user data)
- scripts/ec2_code_inspect.py    read-only SSM probe set, reviewable in PROBES
- findings/ec2_code_discovery_report.md   narrative writeup
- findings/code_dashboard.html            client-facing dashboard
- findings/ec2_code_inspect*.json         raw probe output
- index.html                              links the new dashboard and evidence

All access was read-only: no writes, restarts or config changes on any
instance. Probe output was scanned for credentials before commit; git metadata
was read as the owning user rather than by writing a safe.directory entry.

Claude-Session: https://claude.ai/code/session_01YMxVaHXJsqpqKwncNQ9b1e

index.html

@@ -55,10 +55,16 @@
   <div class="eyebrow">Dasnuve · Cloud Discovery</div>
   <h1>Scrivas — AWS Discovery Reports</h1>
   <p class="lede">Read-only assessment of the Scrivas AWS Organization (<code>o-qfj0pvhhv7</code>) — footprint,
-    security posture, cost, and Organizations governance. Prepared to inform a proposal.</p>
-  <div class="meta">2 accounts · us-east-2 primary · generated 2026-08-19 · CONFIDENTIAL</div>
+    security posture, cost, and Organizations governance — extended with an EC2 source-code recovery and production reliability triage. Prepared to inform a proposal.</p>
+  <div class="meta">2 accounts · us-east-2 primary · generated 2026-08-19, EC2 code pass 2026-08-28 · CONFIDENTIAL</div>
 
   <div class="cards">
+    <a class="card full" href="findings/code_dashboard.html">
+      <span class="k">CODE + RELIABILITY</span>
+      <h2>Source Code &amp; Reliability Triage <span class="badge">time-sensitive</span></h2>
+      <p>All 10 application repos found as full git checkouts on Scrivas-owned EC2 — recoverable despite the contractor holding the GitLab. Plus the reliability triage: 23 prod containers on one host, no memory limits, no swap.</p>
+      <span class="go">Open dashboard →</span>
+    </a>
     <a class="card" href="findings/discovery_dashboard.html">
       <span class="k">FINDINGS</span>
       <h2>Discovery Findings</h2>
@@ -83,6 +89,9 @@
     <h3>Written report &amp; raw evidence</h3>
     <ul>
       <li><a href="findings/discovery_report.md">discovery_report.md</a> — narrative writeup <code>(renders on GitHub)</code></li>
+      <li><a href="findings/ec2_code_discovery_report.md">ec2_code_discovery_report.md</a> — code recovery + reliability triage <code>(renders on GitHub)</code></li>
+      <li><code>findings/ec2_code_inspect.json</code> — SSM probe output, all 7 instances</li>
+      <li><code>findings/ec2_code_inspect_prod.json</code> — prod/stage probe snapshot</li>
       <li><code>findings/org_assessment_report.json</code> — org / trust / delegated-admin raw data</li>
       <li><code>findings/fast_discovery.json</code> — footprint, security, cost raw data</li>
       <li><code>findings/member_lazka_547868853286.json</code> — member account raw data</li>