Add event-driven eBPF execve layer with a Snort-style rule engine

Closes polling's blind spot (processes that exit between sweeps) with a real
eBPF probe and a declarative, data-driven detection engine — inspired by Snort
(rule language, signature IDs) and OSSEC (host-IDS framing).

New events/ subpackage:
- bcc_source.py : eBPF C tracing execve (filename, argv[1..2], ppid, uid,
                  parent comm) over a perf buffer, loaded via bcc; lazy import
                  + available()/try-except so it fails closed to poll-only when
                  bcc/root/BTF are absent — a broken probe never downs the daemon
- exec_event.py : the ExecEvent type
- rules.py      : ExecRule (sid/msg/severity/classtype + path/exec/parent/argv
                  conditions) and ExecRuleEngine; 4 shipped rules (fileless exec
                  100001, reverse-shell argv 100002, web/DB→shell RCE 100003,
                  curl|sh 100004); operators add more via exec_rules_file TOML
- monitor.py    : runs the source on a thread, routes events through the engine

Integration:
- daemon starts the monitor, shares a lock-guarded cooldown with the sweep
  loop, and feeds event alerts into the same snapshot pipeline
- Alert gains Snort-style sid + classtype; retrofitted onto all 7 poll
  detectors; snapshots and JSON now carry them
- config: ebpf_exec_monitor (default on, degrades), exec_rules_file
- systemd: opt-in ebpf.conf drop-in (relaxes MemoryDenyWriteExecute + widens
  caps for bcc's JIT) so the base unit stays hardened for poll-only
- sentinel-redteam: ebpf_exec drill (short-lived /tmp exec + /dev/tcp argv the
  poller can't see); footer now uses the Python CLI

Tests: +14 cases for the rule engine (each default rule match/non-match, rule
validation, parent-exclude). 39/39 pass. Graceful non-root degradation verified.

NOTE: the eBPF C follows bcc's execsnoop pattern but could not be run here
(BPF needs root); it wants a root smoke-test on a real host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/snapshot.py

@@ -61,6 +61,20 @@ RESPONSES: dict[str, str] = {
 }
 
 
+_EXEC_RESPONSE = (
+    "An eBPF rule matched a process execution as it happened (caught even if the "
+    "process has since exited). RESPONSE: review the parent process and the full "
+    "command line, correlate with the captured sockets, and pivot on the parent "
+    "if it's a network-facing service."
+)
+
+
+def _response_for(signature: str) -> str:
+    if signature.startswith("exec_rule."):
+        return _EXEC_RESPONSE
+    return RESPONSES.get(signature, "Review the captured context manually.")
+
+
 def _run(cmd: list[str], timeout: int = 8) -> str:
     try:
         res = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
@@ -105,12 +119,13 @@ def _format_text(report: dict, extras: dict[str, str]) -> str:
     L.append("")
     L.append("## Triggering detections")
     for a in report["alerts"]:
-        L.append(f"  [{a['severity']}] {a['signature']} — {a['detail']}")
+        L.append(f"  [{a['severity']}] sid:{a.get('sid', 0)} "
+                 f"{a['signature']} ({a.get('classtype', '?')}) — {a['detail']}")
     L.append("")
     L.append("## Response guidance")
     for sig in dict.fromkeys(a["signature"] for a in report["alerts"]):
         L.append(f"  • {sig}:")
-        L.append(f"    {RESPONSES.get(sig, 'Review the captured context manually.')}")
+        L.append(f"    {_response_for(sig)}")
     L.append("")
     L.append("## Flagged process detail")
     if report["processes"]: