Add tamper-evidence: package-DB integrity, self-integrity, dead-man's switch

Answers two hard questions: "what guards the hashes FIM trusts?" and "how do we
make the sensor itself hard to silently disable?" — within the honest limit that
a root attacker who shares your privileges can't be fully stopped on-box, only
made loud.

- pkgdb.py: guards the package DB that `pacman -Qkk` trusts. Anchors a
  fingerprint of /var/lib/pacman/local (refreshed ONLY by the pacman hook) and
  cross-checks pacman.log; a DB change with no logged transaction is flagged
  pkgdb_tamper (CRITICAL, sid 100021) — catches an attacker rewriting a stored
  checksum to mask a modified binary. Verified end-to-end against a simulated
  hash-overwrite.
- selfprotect.py: Sentinel's own binaries/config/units/hook are always in the
  FIM watch set (self-integrity); a heartbeat is written each loop; an external
  `watchdog` command polls a remote dashboard and pushes if the sensor goes
  silent or unreachable — silence becomes the alarm.
- daemon: heartbeat + slow-cadence pkgdb check; DB anchor re-anchored in
  build_fim_baseline so the pacman hook refreshes it after each transaction
- web: /api/status now reports heartbeat_age/stale; dashboard shows it
- cli: pkgdb-check, watchdog (--url/--token/--max-age, bypasses min-severity)
- config: pkgdb_verify/_interval, heartbeat_max_age
- README: threat model (trust-anchor problem) + hardening layers (immutability,
  signed-package + external anchor); reframes "anti-rootkit" as tamper-evidence
- tests: +8 (DB fingerprint, anchor/transaction logic, pacman.log parse,
  heartbeat + watchdog verdicts). 80/80 pass

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/enodia-sentinel.toml

@@ -67,6 +67,17 @@ fim_paths = []                   # [] = built-in critical set; or your own list
 fim_pkg_verify = false           # run `pacman -Qkk` (thorough but slow)
 fim_pkg_verify_interval = 21600  # seconds between package verifications
 
+# --- tamper-evidence -----------------------------------------------------
+# Detect out-of-band edits to the pacman DB itself (an attacker rewriting a
+# stored checksum to mask a modified binary). The DB anchor is refreshed only
+# by the pacman hook, so a DB change with no logged transaction = tampering.
+pkgdb_verify = true
+pkgdb_interval = 600             # seconds between DB integrity checks
+heartbeat_max_age = 120          # daemon heartbeat older than this = stale/silent
+# Sentinel's own binaries/config/units/hook are always FIM-watched (self-
+# integrity). For real teeth, make them immutable:  chattr +i <path>
+# and run an external `enodia-sentinel watchdog` against this host's dashboard.
+
 # --- eBPF event layer ----------------------------------------------------
 # Event-driven execve monitor: catches short-lived processes the poll loop
 # misses, matched against the Snort-style rule engine. Requires python-bpfcc