It always starts the same way. An engineer gets paged at 2 a.m., scrambles for SSH into production, and later the compliance team asks, “Who touched what?” That’s when everyone realizes that logs were incomplete, timestamps off, and the evidence was too blurry to satisfy an audit. If