[marcel-breuer]

What changed

• Let status-page operators review automatic incident updates, edit their customer-facing status and message, or suppress publication.
• Keep suppressed updates out of public status payloads and prevent subscriber emails from being sent for them.
• Record edits and suppressions in the private incident timeline; prevent duplicate notification sends.

Why

Completes the operator controls in #1044 while preserving the opt-in, privacy-conscious publishing flow.

Validation

• AutomaticStatusPageIncidentUpdatesTest.php: 4 passed (24 assertions).
• MobileStatusPageWorkspaceApiTest.php targeted workspace test: 1 passed (34 assertions).
• PHPStan: passed (381 files).
• Rector dry run: passed.
• Pint: 10 changed PHP files passed with Pint/laravel_blade excluded because the configured Blade rule cannot start in the PHP container; CI runs the full configured check.
• Docker frontend production build: passed.

Risks / follow-up

• Full browser interaction coverage is not included; the API behavior is covered by feature tests and the frontend production build passed.

Closes #1044