Add event-driven eBPF execve layer with a Snort-style rule engine

Closes polling's blind spot (processes that exit between sweeps) with a real
eBPF probe and a declarative, data-driven detection engine — inspired by Snort
(rule language, signature IDs) and OSSEC (host-IDS framing).

New events/ subpackage:
- bcc_source.py : eBPF C tracing execve (filename, argv[1..2], ppid, uid,
                  parent comm) over a perf buffer, loaded via bcc; lazy import
                  + available()/try-except so it fails closed to poll-only when
                  bcc/root/BTF are absent — a broken probe never downs the daemon
- exec_event.py : the ExecEvent type
- rules.py      : ExecRule (sid/msg/severity/classtype + path/exec/parent/argv
                  conditions) and ExecRuleEngine; 4 shipped rules (fileless exec
                  100001, reverse-shell argv 100002, web/DB→shell RCE 100003,
                  curl|sh 100004); operators add more via exec_rules_file TOML
- monitor.py    : runs the source on a thread, routes events through the engine

Integration:
- daemon starts the monitor, shares a lock-guarded cooldown with the sweep
  loop, and feeds event alerts into the same snapshot pipeline
- Alert gains Snort-style sid + classtype; retrofitted onto all 7 poll
  detectors; snapshots and JSON now carry them
- config: ebpf_exec_monitor (default on, degrades), exec_rules_file
- systemd: opt-in ebpf.conf drop-in (relaxes MemoryDenyWriteExecute + widens
  caps for bcc's JIT) so the base unit stays hardened for poll-only
- sentinel-redteam: ebpf_exec drill (short-lived /tmp exec + /dev/tcp argv the
  poller can't see); footer now uses the Python CLI

Tests: +14 cases for the rule engine (each default rule match/non-match, rule
validation, parent-exclude). 39/39 pass. Graceful non-root degradation verified.

NOTE: the eBPF C follows bcc's execsnoop pattern but could not be run here
(BPF needs root); it wants a root smoke-test on a real host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/sentinel-redteam

@@ -110,6 +110,18 @@ drill_persistence() {
     echo "    -> wrote $SANDBOX/authorized_keys"
 }
 
+drill_ebpf_exec() {
+    note ebpf_exec "short-lived /tmp exec + reverse-shell-pattern argv (only the eBPF monitor catches these)"
+    cp /bin/true "$TMP/enodia-drill-exec" 2>/dev/null
+    "$TMP/enodia-drill-exec"   # runs and exits in <1ms — the poll loop can't see it (sid 100001)
+    # argv carries a /dev/tcp pattern -> sid 100002 (connects to discard:9, harmless)
+    ( exec -a enodia-drill-revsh bash -c 'cat < /dev/tcp/127.0.0.1/9 2>/dev/null; true' ) &
+    PIDS+=("$!")
+    echo "    -> fired a short-lived /tmp exec (sid 100001) and a /dev/tcp argv (sid 100002)"
+    echo "       NOTE: needs the eBPF monitor (run the service as root). With polling only"
+    echo "       these vanish between sweeps — which is exactly what the eBPF layer fixes."
+}
+
 run() {
     case "$1" in
         reverse_shell) drill_reverse_shell ;;
@@ -118,11 +130,12 @@ run() {
         new_listener)  drill_new_listener ;;
         new_suid)      drill_new_suid ;;
         persistence)   drill_persistence ;;
+        ebpf_exec)     drill_ebpf_exec ;;
         *) echo "unknown drill: $1" >&2; return 1 ;;
     esac
 }
 
-ALL=(reverse_shell ld_preload deleted_exe new_listener new_suid persistence)
+ALL=(reverse_shell ld_preload deleted_exe new_listener new_suid persistence ebpf_exec)
 
 if [ "${1:-}" = "--list" ]; then printf '%s\n' "${ALL[@]}"; exit 0; fi
 
@@ -135,11 +148,14 @@ echo "######################################################################"
 if [ "$#" -gt 0 ]; then targets=("$@"); else targets=("${ALL[@]}"); fi
 for d in "${targets[@]}"; do run "$d"; done
 
-echo -e "\n[*] drills live for ${HOLD}s. Triggering a Sentinel sweep check now:"
-if [ -x /usr/local/bin/sentinel.sh ]; then
-    sudo /usr/local/bin/sentinel.sh --check 2>/dev/null \
-        | grep -i drill && echo "    ^ Sentinel saw the drills." \
-        || echo "    (run 'sudo sentinel.sh --check' yourself, or watch events.log)"
+echo -e "\n[*] drills live for ${HOLD}s. Run a one-shot poll check now:"
+if command -v enodia-sentinel >/dev/null 2>&1; then
+    enodia-sentinel check 2>/dev/null | grep -i 'drill\|/tmp/enodia' \
+        && echo "    ^ Sentinel's poll detectors saw the drills." \
+        || echo "    (no poll hits yet — watch /var/log/enodia-sentinel/events.log)"
+else
+    echo "    (enodia-sentinel not on PATH — watch /var/log/enodia-sentinel/events.log)"
 fi
+echo "    The 'ebpf_exec' drill only shows up with the eBPF monitor (service as root)."
 echo "[*] holding for ${HOLD}s, then cleaning up..."
 sleep "$HOLD"