AI Developer Supply Chain Incident Response: What to Check After a Tool or Package Compromise