Triage a Claude Code alert where the agent's trusted context is subverted through its own artifacts, CLAUDE.md, settings.json or settings.local.json, the .claude directory, hooks, or MCP configuration, read against the Claude Code telemetry (session, operation, decision, event_name).
