Re-architect Sentinel as a zero-dependency Python package

Port the bash prototype to a structured, testable Python codebase while
preserving the same control loop and the seven detection signatures. The bash
implementation stays in src/ as the regression oracle.

Highlights:
- enodia_sentinel/ package (stdlib only — no runtime deps):
  - detectors/ : one pure function per signature, detect(state, cfg)->Alerts
  - system.py  : SystemState — one cached /proc + ss snapshot per sweep,
                 fully injectable so detectors are unit-testable
  - daemon.py  : sweep loop, in-process cooldown dedup, threaded snapshot
                 capture, and a SUID filesystem scan moved OFF the loop
                 thread onto a slow background cadence
  - snapshot.py: forensic text + JSON sidecar with per-signature IR guidance
  - config.py  : dataclass config via TOML + env overrides
  - netutil.py : public-IP / CIDR logic via stdlib ipaddress
- tests/ : 25 stdlib-unittest cases (no root, no /proc, no ss needed)
- TOML config, launcher wrapper, Makefile (pip-free install), hardened
  systemd unit (env-resolved ExecStart), updated PKGBUILD, rewritten README

Performance: per-sweep cost ~200 ms (shared cached state); the multi-second
SUID walk no longer blocks detection. scandir-based walk replaces os.walk.

Verified on Arch: all 7 detectors fire on red-team drills (reverse_shell,
ld_preload, deleted_exe, new_listener, new_suid confirmed live end-to-end),
no false positives on a clean sweep, 25/25 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/config.py

@@ -0,0 +1,117 @@
+"""Runtime configuration.
+
+Defaults live here; overrides come from a TOML file (default
+``/etc/enodia-sentinel.toml``, or ``$ENODIA_CONFIG``) and a couple of env vars
+useful for testing without root (``$ENODIA_LOG_DIR``).
+"""
+from __future__ import annotations
+
+import os
+import tomllib
+from dataclasses import dataclass, field, fields
+from pathlib import Path
+
+_DEFAULT_INTERPRETERS = (
+    "bash sh dash zsh ksh ash nc ncat netcat socat telnet "
+    "python python2 python3 perl ruby php lua awk"
+).split()
+
+_DEFAULT_WATCH = (
+    "/etc/cron.d", "/etc/crontab", "/etc/cron.daily", "/etc/cron.hourly",
+    "/etc/cron.weekly", "/var/spool/cron", "/etc/systemd/system",
+    "/etc/ld.so.preload", "/etc/passwd", "/etc/sudoers", "/etc/sudoers.d",
+    "/root/.ssh/authorized_keys", "/root/.bashrc", "/root/.profile",
+)
+
+_ALL_DETECTORS = (
+    "reverse_shell", "ld_preload", "deleted_exe",
+    "new_listener", "new_suid", "persistence", "egress",
+)
+
+
+@dataclass
+class Config:
+    # timing
+    sample_interval: float = 4.0
+    cooldown: int = 60
+    baseline_grace: int = 10
+    suid_refresh: int = 3600
+    suid_scan_interval: int = 60
+
+    # detector toggles
+    detectors: frozenset[str] = frozenset(_ALL_DETECTORS)
+
+    # tuning
+    interpreters: frozenset[str] = frozenset(_DEFAULT_INTERPRETERS)
+    egress_allow_cidrs: tuple[str, ...] = ()
+    listener_allow_ports: frozenset[str] = frozenset()
+    suid_hot_dirs: tuple[str, ...] = (
+        "/tmp", "/dev/shm", "/var/tmp", "/home", "/run/user",
+    )
+    # Writable dirs always scanned for SUID even if on a separate filesystem
+    # (tmpfs /tmp etc.). Kept small so the gated scan stays cheap.
+    suid_scan_extra_dirs: tuple[str, ...] = (
+        "/tmp", "/dev/shm", "/var/tmp", "/run/user",
+    )
+    watch_persistence: tuple[str, ...] = _DEFAULT_WATCH
+
+    # eBPF on-ramp
+    capture_execve_bpftrace: bool = False
+
+    # retention
+    max_snapshots: int = 300
+    max_snapshot_age_days: int = 60
+
+    # notifications
+    notify_users: tuple[str, ...] = ()
+    notify_urgency: str = "critical"
+
+    # paths
+    log_dir: Path = Path("/var/log/enodia-sentinel")
+
+    # ---- derived paths ---------------------------------------------------
+    @property
+    def events_log(self) -> Path:
+        return self.log_dir / "events.log"
+
+    @property
+    def listener_baseline(self) -> Path:
+        return self.log_dir / "listener-baseline.json"
+
+    @property
+    def suid_baseline(self) -> Path:
+        return self.log_dir / "suid-baseline.json"
+
+    # ---- loading ---------------------------------------------------------
+    @classmethod
+    def load(cls, path: str | os.PathLike | None = None) -> "Config":
+        cfg = cls()
+
+        env_log = os.environ.get("ENODIA_LOG_DIR")
+        if env_log:
+            cfg.log_dir = Path(env_log)
+
+        cfg_path = Path(path or os.environ.get("ENODIA_CONFIG")
+                        or "/etc/enodia-sentinel.toml")
+        if cfg_path.is_file():
+            cfg._apply_toml(cfg_path)
+        return cfg
+
+    def _apply_toml(self, path: Path) -> None:
+        with open(path, "rb") as fh:
+            data = tomllib.load(fh)
+        known = {f.name for f in fields(self)}
+        for key, value in data.items():
+            if key not in known:
+                continue
+            current = getattr(self, key)
+            if isinstance(current, frozenset):
+                value = frozenset(value)
+            elif isinstance(current, tuple):
+                value = tuple(value)
+            elif isinstance(current, Path):
+                value = Path(value)
+            setattr(self, key, value)
+
+    def enabled(self, detector: str) -> bool:
+        return detector in self.detectors