Add false-positive triage via package-ownership provenance

A noisy IDS gets ignored. Adds explicit FP-handling built on provenance — a
binary owned by the package manager is almost certainly legitimate (the OSSEC
rootcheck / AIDE principle).

- provenance.py: package_owner()/is_package_owned() via pacman/dpkg/rpm, cached;
  framed as confidence-raising, never proof-of-safety
- triage.py: triage_alert() labels each detection likely-FP vs review with a
  reason (package-owned binary, loopback-only listener, allowlisted comm, …);
  reverse_shell/egress/exec rules are ALWAYS review (provenance can't clear a
  network shell); unattributable listeners are reviewed, not cleared
- cli: `enodia-sentinel triage` summarizes captured alerts and suggests
  allowlist entries
- new_listener: listener_allow_comms + optional suppress_package_owned_listeners
  gate (the best single knob for a desktop/seedbox running P2P apps)
- tests: +10 (provenance injected); README + config documented. 65/65 pass

Verified on a live seedbox: 12 detections, 11 auto-cleared as FP (qbittorrent /
nicotine / kdeconnectd / the dashboard itself), 1 correctly held for review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/config.py

@@ -46,6 +46,11 @@ class Config:
     interpreters: frozenset[str] = frozenset(_DEFAULT_INTERPRETERS)
     egress_allow_cidrs: tuple[str, ...] = ()
     listener_allow_ports: frozenset[str] = frozenset()
+    # Listeners owned by these process names never alert (e.g. P2P clients).
+    listener_allow_comms: frozenset[str] = frozenset()
+    # Suppress new_listener when the listening binary is package-owned (strong
+    # provenance signal; off by default so the detector stays honest).
+    suppress_package_owned_listeners: bool = False
     suid_hot_dirs: tuple[str, ...] = (
         "/tmp", "/dev/shm", "/var/tmp", "/home", "/run/user",
     )