Re-architect Sentinel as a zero-dependency Python package

Port the bash prototype to a structured, testable Python codebase while
preserving the same control loop and the seven detection signatures. The bash
implementation stays in src/ as the regression oracle.

Highlights:
- enodia_sentinel/ package (stdlib only — no runtime deps):
  - detectors/ : one pure function per signature, detect(state, cfg)->Alerts
  - system.py  : SystemState — one cached /proc + ss snapshot per sweep,
                 fully injectable so detectors are unit-testable
  - daemon.py  : sweep loop, in-process cooldown dedup, threaded snapshot
                 capture, and a SUID filesystem scan moved OFF the loop
                 thread onto a slow background cadence
  - snapshot.py: forensic text + JSON sidecar with per-signature IR guidance
  - config.py  : dataclass config via TOML + env overrides
  - netutil.py : public-IP / CIDR logic via stdlib ipaddress
- tests/ : 25 stdlib-unittest cases (no root, no /proc, no ss needed)
- TOML config, launcher wrapper, Makefile (pip-free install), hardened
  systemd unit (env-resolved ExecStart), updated PKGBUILD, rewritten README

Performance: per-sweep cost ~200 ms (shared cached state); the multi-second
SUID walk no longer blocks detection. scandir-based walk replaces os.walk.

Verified on Arch: all 7 detectors fire on red-team drills (reverse_shell,
ld_preload, deleted_exe, new_listener, new_suid confirmed live end-to-end),
no false positives on a clean sweep, 25/25 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/detectors/__init__.py

@@ -0,0 +1,62 @@
+"""Detector registry.
+
+Each detector is a ``Detector`` with a ``name`` and a ``detect(state, cfg)``
+callable yielding ``Alert``s. They are pure functions of the injected
+``SystemState`` + ``Config``, which is what makes them unit-testable without
+root or a live system.
+"""
+from __future__ import annotations
+
+from collections.abc import Callable, Iterable, Iterator
+from dataclasses import dataclass
+
+from ..alert import Alert
+from ..config import Config
+from ..system import SystemState
+from . import (
+    deleted_exe,
+    egress,
+    ld_preload,
+    new_listener,
+    new_suid,
+    persistence,
+    reverse_shell,
+)
+
+DetectFn = Callable[[SystemState, Config], Iterable[Alert]]
+
+
+@dataclass(frozen=True)
+class Detector:
+    name: str
+    detect: DetectFn
+    needs_baseline: bool = False  # gated until after the grace window
+    expensive: bool = False       # gated to the slow scan cadence
+
+
+# Order here is the order signatures appear in a snapshot.
+REGISTRY: tuple[Detector, ...] = (
+    Detector("reverse_shell", reverse_shell.detect),
+    Detector("ld_preload", ld_preload.detect),
+    Detector("deleted_exe", deleted_exe.detect),
+    Detector("egress", egress.detect),
+    Detector("new_listener", new_listener.detect, needs_baseline=True),
+    Detector("persistence", persistence.detect, needs_baseline=True),
+    Detector("new_suid", new_suid.detect, needs_baseline=True, expensive=True),
+)
+
+
+def run_all(
+    state: SystemState,
+    cfg: Config,
+    *,
+    include: Iterable[str] | None = None,
+) -> Iterator[Alert]:
+    """Run the enabled detectors whose names are in ``include`` (or all)."""
+    wanted = set(include) if include is not None else None
+    for det in REGISTRY:
+        if not cfg.enabled(det.name):
+            continue
+        if wanted is not None and det.name not in wanted:
+            continue
+        yield from det.detect(state, cfg)