Add typed host event egress rule

CLAUDE.md

@@ -13,7 +13,8 @@ network blocking or automatic host mutation.
 
 Primary functions:
 
-- Detect: poll detectors plus optional eBPF exec/syscall rules.
+- Detect: poll detectors, optional eBPF exec/syscall rules, and typed
+  host-event rule fixtures.
 - Prevent: posture findings plus reviewed containment/recovery plans.
 - Verify: FIM, package DB anchor, signed-package verification, rootcheck.
 - Investigate: text/JSON snapshots, incidents, HTTPS management console.
@@ -39,6 +40,9 @@ Implemented detection coverage:
   web/database service spawning shells, and `curl|wget|sh` style staging.
 - eBPF syscall rules: RWX `mprotect`/`mmap`, `memfd_create`, sensitive
   `ptrace`, seccomp changes, cross-process memory access, and memory locking.
+- Typed host-event rules: `tcp_connect` JSON fixtures can already exercise
+  interpreter egress to unusual public ports; live event sources are still
+  future work.
 - Anti-rootkit checks: hidden PIDs, `/proc` vs `ps` mismatches, hidden modules,
   hidden TCP/UDP/raw/special-protocol sockets, raw ICMP/SCTP-style channels,
   promiscuous interfaces, known LKM rootkit names, module taint, and kernel
@@ -59,7 +63,8 @@ Implemented investigation/response state:
   persists CLI-generated plans under `response-plans/`, and appends
   `response-audit.log`. Dashboard/API plan previews do not write artifacts.
 - `rules list/show/test` exposes built-in and configured event rules and lets
-  operators test exec/syscall event JSON fixtures against the rule engines.
+  operators test exec, syscall, and typed host-event JSON fixtures against the
+  rule engines.
 - `rules docs` emits generated Markdown rule docs; `docs/RULES.md` is the
   checked-in built-in rule reference with match fields, false positives, and
   drill guidance.
@@ -125,7 +130,8 @@ Start with:
 - `daemon.py` runs sweep/cooldown/background tasks.
 - `system.py` builds one cached injectable view of processes and sockets.
 - `detectors/` contains pure poll detectors.
-- `events/` contains optional eBPF exec/syscall monitoring and declarative rules.
+- `events/` contains optional eBPF exec/syscall monitoring plus declarative
+  exec, syscall, and typed host-event rules.
 - `snapshot.py` writes forensic `.log` and `.json` evidence.
 - `incident.py` groups snapshots by process lineage and time window.
 - `respond.py` builds read-only response plans from incident evidence; the CLI