fix(agent99): use canonical callback incident id

apps/api/tests/test_agent99_control_plane_outcome_contract.py

@@ -102,6 +102,17 @@ def test_agent99_posts_fenced_outcome_to_production_ingestion() -> None:
         assert field in source
 
 
+def test_agent99_completion_callback_uses_bounded_canonical_incident_id() -> None:
+    source = _CONTROL_PLANE.read_text(encoding="utf-8")
+
+    assert "function Get-AgentCompletionCallbackIncidentId" in source
+    assert 'Get-AgentObjectValue $identity "incident_id" ""' in source
+    assert 'return "INC-AG99-' in source
+    assert "$callbackIncidentId = Get-AgentCompletionCallbackIncidentId" in source
+    assert "alert_id = $callbackIncidentId" in source
+    assert "alert_id = if ($alertId)" not in source
+
+
 def test_agent99_backupcheck_reads_offsite_and_escrow_without_mutation() -> None:
     source = _CONTROL_PLANE.read_text(encoding="utf-8")
     readback = source[