Add typed host event egress rule

docs/ROADMAP.md

@@ -128,9 +128,12 @@ Exit criteria:
 
 Purpose: reduce blind spots and connect related signals.
 
-- Generalize the exec-rule engine into a typed host-event rule engine:
-  `exec`, `tcp_connect`, `bind`, `listen`, `accept`, `file_write`,
-  `chmod/chown`, `setuid/setgid`, `capset`, and module-load events.
+- ✅ Add the first typed host-event rule family beside exec/syscall rules:
+  `rules test` accepts `tcp_connect` event JSON and ships SID `100067` for
+  interpreter egress to unusual public ports, with a replayable fixture.
+- Continue generalizing the rule engine across more typed host events:
+  `bind`, `listen`, `accept`, `file_write`, `chmod/chown`, `setuid/setgid`,
+  `capset`, and module-load events.
 - Keep rules declarative and Snort-like:
   `sid`, `msg`, `severity`, `classtype`, `event`, and match fields such as
   process name, parent process, argv regex, path prefix, peer IP/port, UID/GID,
@@ -151,11 +154,10 @@ Purpose: reduce blind spots and connect related signals.
     suspected trojaned binary with checksum cover-up.
   - web/database service spawning shell + tool transfer (`curl|wget|sh`) →
     CRITICAL likely RCE payload staging.
-- Add high-signal living-off-the-land detections:
+- Add additional high-signal living-off-the-land detections:
   `curl|wget | sh`, Python/perl/bash reverse-shell argv variants,
   `systemctl enable` from unusual ancestry, `chmod +s` outside package
-  transactions, interpreter egress to unusual public ports, and execution from
-  writable directories.
+  transactions, and execution from writable directories.
 - Add first-seen and rarity tracking for local network behavior:
   first public destination per process name, first listening port per binary,
   interpreter connections to non-standard ports, and long-lived low-byte