Add false-positive triage via package-ownership provenance

A noisy IDS gets ignored. Adds explicit FP-handling built on provenance — a
binary owned by the package manager is almost certainly legitimate (the OSSEC
rootcheck / AIDE principle).

- provenance.py: package_owner()/is_package_owned() via pacman/dpkg/rpm, cached;
  framed as confidence-raising, never proof-of-safety
- triage.py: triage_alert() labels each detection likely-FP vs review with a
  reason (package-owned binary, loopback-only listener, allowlisted comm, …);
  reverse_shell/egress/exec rules are ALWAYS review (provenance can't clear a
  network shell); unattributable listeners are reviewed, not cleared
- cli: `enodia-sentinel triage` summarizes captured alerts and suggests
  allowlist entries
- new_listener: listener_allow_comms + optional suppress_package_owned_listeners
  gate (the best single knob for a desktop/seedbox running P2P apps)
- tests: +10 (provenance injected); README + config documented. 65/65 pass

Verified on a live seedbox: 12 detections, 11 auto-cleared as FP (qbittorrent /
nicotine / kdeconnectd / the dashboard itself), 1 correctly held for review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/cli.py

@@ -62,6 +62,7 @@ def main(argv: list[str] | None = None) -> int:
     sub.add_parser("baseline", help="rebuild listener/SUID baselines")
     sub.add_parser("list-detectors", help="list available detectors")
     sub.add_parser("web", help="serve the read-only dashboard")
+    sub.add_parser("triage", help="classify captured alerts as likely-FP vs review")
 
     args = parser.parse_args(argv)
     cfg = Config.load(args.config)
@@ -79,8 +80,53 @@ def main(argv: list[str] | None = None) -> int:
         from .web import serve
         serve(cfg)
         return 0
+    if args.cmd == "triage":
+        return _cmd_triage(cfg)
     return _cmd_run(cfg)
 
 
+def _cmd_triage(cfg: Config) -> int:
+    import json
+    from collections import OrderedDict
+
+    from .triage import LIKELY_FP, triage_alert
+
+    seen: OrderedDict[tuple, dict] = OrderedDict()
+    for p in sorted(cfg.log_dir.glob("alert-*.json")):
+        try:
+            d = json.loads(p.read_text())
+        except (OSError, ValueError):
+            continue
+        procs = d.get("processes", [])
+        for a in d.get("alerts", []):
+            key = (a.get("signature"), a.get("detail", "").split(" cmd=")[0])
+            if key in seen:
+                seen[key]["count"] += 1
+                continue
+            v = triage_alert(a, procs, cfg)
+            seen[key] = {"alert": a, "verdict": v, "count": 1}
+
+    if not seen:
+        print("No alerts to triage.")
+        return 0
+
+    fp = sum(1 for e in seen.values() if e["verdict"].label == LIKELY_FP)
+    print(f"{len(seen)} distinct detections — {fp} likely false-positive, "
+          f"{len(seen) - fp} to review.\n")
+    suggestions = set()
+    for e in sorted(seen.values(), key=lambda e: e["verdict"].label):
+        a, v = e["alert"], e["verdict"]
+        tag = "FP  " if v.label == LIKELY_FP else "REVIEW"
+        print(f"[{tag}] {a.get('signature'):14} x{e['count']:<3} {v.reason}")
+        print(f"         {a.get('detail', '')[:100]}")
+        if v.suggest:
+            suggestions.add(v.suggest)
+    if suggestions:
+        print("\nTo suppress the false positives, add to your config:")
+        for s in sorted(suggestions):
+            print(f"  # {s}")
+    return 0
+
+
 if __name__ == "__main__":
     sys.exit(main())