Use when suspicious local processes, listeners, persistence, or unexplained traffic need a non-destructive Codex forensic workflow.
