Add event-driven eBPF execve layer with a Snort-style rule engine

Closes polling's blind spot (processes that exit between sweeps) with a real
eBPF probe and a declarative, data-driven detection engine — inspired by Snort
(rule language, signature IDs) and OSSEC (host-IDS framing).

New events/ subpackage:
- bcc_source.py : eBPF C tracing execve (filename, argv[1..2], ppid, uid,
                  parent comm) over a perf buffer, loaded via bcc; lazy import
                  + available()/try-except so it fails closed to poll-only when
                  bcc/root/BTF are absent — a broken probe never downs the daemon
- exec_event.py : the ExecEvent type
- rules.py      : ExecRule (sid/msg/severity/classtype + path/exec/parent/argv
                  conditions) and ExecRuleEngine; 4 shipped rules (fileless exec
                  100001, reverse-shell argv 100002, web/DB→shell RCE 100003,
                  curl|sh 100004); operators add more via exec_rules_file TOML
- monitor.py    : runs the source on a thread, routes events through the engine

Integration:
- daemon starts the monitor, shares a lock-guarded cooldown with the sweep
  loop, and feeds event alerts into the same snapshot pipeline
- Alert gains Snort-style sid + classtype; retrofitted onto all 7 poll
  detectors; snapshots and JSON now carry them
- config: ebpf_exec_monitor (default on, degrades), exec_rules_file
- systemd: opt-in ebpf.conf drop-in (relaxes MemoryDenyWriteExecute + widens
  caps for bcc's JIT) so the base unit stays hardened for poll-only
- sentinel-redteam: ebpf_exec drill (short-lived /tmp exec + /dev/tcp argv the
  poller can't see); footer now uses the Python CLI

Tests: +14 cases for the rule engine (each default rule match/non-match, rule
validation, parent-exclude). 39/39 pass. Graceful non-root degradation verified.

NOTE: the eBPF C follows bcc's execsnoop pattern but could not be run here
(BPF needs root); it wants a root smoke-test on a real host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/detectors/deleted_exe.py

@@ -37,4 +37,6 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
             key=f"del:{proc.pid}",
             detail=f"pid={proc.pid} comm={proc.comm} exe=[{exe}]",
             pids=(proc.pid,),
+            sid=100012,
+            classtype="fileless-execution",
         )

enodia_sentinel/detectors/egress.py

@@ -33,4 +33,6 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
                 "(interpreter to public IP)"
             ),
             pids=(s.pid,) if s.pid else (),
+            sid=100016,
+            classtype="c2-exfil",
         )

enodia_sentinel/detectors/ld_preload.py

@@ -31,6 +31,8 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
             signature="ld_preload",
             key="ldp:global",
             detail=f"/etc/ld.so.preload is non-empty: [{contents.replace(chr(10), ' ')}]",
+            sid=100011,
+            classtype="rootkit-preload",
         )
 
     for proc in state.processes:
@@ -44,4 +46,6 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
                 key=f"ldp:{proc.pid}",
                 detail=f"pid={proc.pid} comm={proc.comm} LD_PRELOAD=[{pre}]",
                 pids=(proc.pid,),
+                sid=100011,
+                classtype="rootkit-preload",
             )

enodia_sentinel/detectors/new_listener.py

@@ -31,4 +31,6 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
             key=f"lis:{key}",
             detail=f"new listening socket {s.local} by comm={comm}",
             pids=(s.pid,) if s.pid else (),
+            sid=100013,
+            classtype="backdoor-listener",
         )

enodia_sentinel/detectors/new_suid.py

@@ -33,4 +33,6 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
                 ("SUID/SGID binary in writable dir: " if hot
                  else "new SUID/SGID binary: ") + path
             ),
+            sid=100014,
+            classtype="privilege-escalation",
         )

enodia_sentinel/detectors/persistence.py

@@ -40,4 +40,6 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
                 signature="persistence",
                 key=f"persist:{path}",
                 detail=f"persistence file modified: {path}",
+                sid=100015,
+                classtype="persistence",
             )

enodia_sentinel/detectors/reverse_shell.py

@@ -35,4 +35,6 @@ def detect(state: SystemState, cfg: Config) -> Iterator[Alert]:
                 f"peer=[{peer}] cmd=[{proc.cmdline[:90]}]"
             ),
             pids=(proc.pid,),
+            sid=100010,
+            classtype="c2-reverse-shell",
         )