Route incident records to an allowed evidence folder

Defect (`docs/compliance/risk-register.md:109`, R-SOC-21): `docs/compliance/incident-register.md:5` says incident records go to the evidence store under `incidents/<id>/`, but `tools/evidence_store.py:29-32` `CONTROLS` has no `incidents` entry, so filing an incident record is refused — the first real incident would have nowhere to land. Fix: add `incidents` to `CONTROLS` (and to whatever lists the 13 evidence folders, e.g. the readiness checklist / AC15.1 wording) OR change the incident register to `reviews/` — pick adding `incidents` (it matches the incident-response policy's own wording). Add/extend a test asserting `incidents` is accepted. Out of scope: creating any object in the prod evidence bucket (no placeholder objects); other folders; incident-response policy content. Done means: - `python3 -c 'from tools.evidence_store import CONTROLS; assert "incidents" in CONTROLS'` (or the module's test) passes — cite. - R-SOC-21 row marked fixed on develop; `./dc check full` + `python3 tools/check_context.py` green; PR merged to develop.

Added `incidents` to the evidence store CONTROLS, README table, incident-register wording and the test; R-SOC-21 Closed — fixed. PR #4789 merged; CI gate green; Jaah Deploy succeeded on develop. Local full gate: only api-unit failed, and it passed on rerun.