incidents: add the 2026-10-02 gateway outage write-up (from the unmerged incident branch)

The write-up has sat on incident/2026-10-02-gateway-cve-upgrade since the
outage and that branch is now far behind main. This lifts just the incident
text and the CVE note into incidents/, attributed to InferenceBot with the
substance unchanged, and links it from infrastructure.md under a new
Incident log section.

infrastructure.md

@@ -204,3 +204,8 @@ through it; the other providers are called directly.
 Maintaining the co-op's infrastructure — rotating Cloudron tokens, editing the
 portal's environment, and troubleshooting the provisioning pipeline — is
 documented in the [operator runbook](operator-token-runbook.md).
+
+## Incident log
+
+Write-ups for outages live in [`incidents/`](incidents/). One so far:
+[2026-10-02 — gateway outage after a security-upgrade rebuild](incidents/2026-10-02-gateway-cve-upgrade.md).