Summary

• Add timestamp provenance preflight guidance for event time, device time, collector time, ingestion time, and normalized time.
• Add entity-normalization evidence for cross-source user, host, device, IP, and cloud-principal pivots.
• Extend the output template with source quality, ingestion lag, clock-skew, parser/schema, and join-confidence fields.
• Add severity and pitfall guidance for ingestion-order timelines, raw local timestamps, and ambiguous entity joins.

Validation

• git diff --check
• Local frontmatter check using the repository workflow required fields
• Local prompt-injection scan using the repository workflow patterns

Closes #1142

Bounty

Improver contribution. Preferred payment method can be provided privately after acceptance.