"""Log agent: prefilter → LLM guard → LLM planner → validation → grep (ARCHITECTURE §2.8, ADR-007, ADR-013).

Logs never reach the LLM: the planner sees only the user's question and the container names.
"""