Choice and consequence: A naturalistic analysis of least-worst decision-making in critical incidents