scc: pavon owncloud diagnostic scratch scripts from 2026-04-29 session

Six small bash scripts uploaded to /tmp on 172.16.3.22 during the
OwnCloud cron stacking incident — investigation, group enumeration,
failed group-restrict attempt, occ subcommand discovery. Captured for
audit; full context in clients/pavon/session-logs/2026-04-29-session.md.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

temp/owncloud-investigate.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+echo === LOAD ===
+uptime
+echo
+echo === CIFS UTILS ===
+rpm -q cifs-utils 2>&1
+which mount.cifs 2>&1
+echo
+echo === EXISTING SMB MOUNTS ===
+mount | grep -iE 'cifs|smb|172.16.3.21' || echo "(none)"
+echo
+echo === SUBDIR FILE COUNTS ===
+for d in /owncloud/pavon/files/*/; do
+    name="${d#/owncloud/pavon/files/}"
+    name="${name%/}"
+    count=$(find "$d" -maxdepth 4 -type f 2>/dev/null | wc -l)
+    echo "$count files: $name"
+done
+echo
+echo === ESTIMATED FILES OLDER THAN 365 DAYS ===
+find /owncloud/pavon/files -type f -mtime +365 2>/dev/null | wc -l