Add investigate-trace template and improve root cause analysis (#251)

* Add investigate-trace template and improve root cause analysis

Add a purpose-built investigate-trace template for ETW/telemetry/profiling
trace analysis, based on real-world feedback from an LLM executing an
assembled investigate-bug prompt for Windows power trace analysis.

New template (investigate-trace):
- Call stack analysis as primary technique, not afterthought
- Energy-vs-metric divergence detection (CPU% vs energy%)
- Cross-process amplification cascade analysis
- Tool-agnostic analysis steps (not WPA-specific)
- Iterative deepening workflow: broad survey → module → stack → cross-process

Protocol improvements (root-cause-analysis):
- Phase 3a: Iterative Deepening — investigation proceeds in layers of
  increasing resolution; do not write report until deep analysis complete
- Phase 4a: Cross-Component Causal Chains — trace trigger-response pairs,
  map amplification cascades, quantify amplification factors, identify
  leverage points

Guardrail improvements:
- anti-hallucination: scoped labeling relaxation for direct observations
  from authoritative tool output; causal claims retain full labeling
- operational-constraints: data-driven scoping rules for trace/telemetry
  analysis (data categories and time ranges, not file counts)

Format and template improvements:
- investigation-report: recognize template-level full-format overrides
- investigate-bug: explicit full-format override for root cause tasks
- bootstrap: taxonomy relevance evaluation during assembly

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address PR #251 review feedback

- Align ASSUMED marker with anti-hallucination protocol ([ASSUMPTION])
- Soften 'at least top 5' to 'up to 5' with data-limitation escape hatch
  in both investigate-trace template and root-cause-analysis protocol
- Add investigate-trace to root-cause-analysis applicable_to list
- Remove root-cause-ci-failure from full-format example list (not applicable)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address second round of PR #251 review feedback

- Add low-CPU edge case handling for energy-to-CPU ratio threshold
- Qualify call stack requirement as 'when available' in quality checklist
- Align [UNKNOWN] marker with protocol's [UNKNOWN: <what is missing>]
- Fix remaining INFERRED/ASSUMED instance to use [ASSUMPTION] marker

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix section count mismatch with investigation-report format

Remove hardcoded '8 sections' from investigate-trace and investigate-bug
templates — the investigation-report format defines 9 sections (§1–§9).
Avoids drift by not embedding a count that the format owns.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Alan Jowett <alan.jowett@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>