Expand rootkit monitoring and Claude docs

docs/COMMAND_REFERENCE.md

@@ -76,7 +76,11 @@ Runs anti-rootkit cross-view checks once:
 - PIDs alive via `kill(pid, 0)` but missing from `/proc`.
 - Live modules in `/sys/module` but missing from `/proc/modules`.
 - Listening TCP ports in `/proc/net/tcp*` but missing from `ss`.
+- UDP ports in `/proc/net/udp*` but missing from `ss -u`.
 - Network interfaces in promiscuous mode.
+- Known rootkit module names.
+- Tainted loaded modules (`/sys/module/*/taint`) and global kernel taint
+  (`/proc/sys/kernel/tainted`).
 
 Exit code:
 
@@ -261,6 +265,10 @@ HTTPS is mandatory. If `web_tls_cert` / `web_tls_key` are not configured,
 Sentinel creates a self-signed pair under `log_dir`; add a browser exception for
 that certificate or replace it with a private/local CA certificate.
 
+The console exposes incidents, alert snapshots, posture findings, event tail,
+and dry-run response plans. It remains read-only; response commands are displayed
+for review but not executed from the browser.
+
 Expected use: `enodia-sentinel-web.service`.
 
 ### `triage`