Expand rootkit monitoring and Claude docs

enodia_sentinel/config.py

@@ -82,6 +82,9 @@ class Config:
     rootcheck_enabled: bool = True
     rootcheck_interval: int = 300            # seconds between cross-view sweeps
     rootcheck_pid_cap: int = 65536           # upper PID to brute-force via kill(0)
+    # Legitimate out-of-tree/proprietary/unsigned modules accepted by operator
+    # policy (e.g. vendor GPU or virtualization drivers).
+    rootcheck_module_allow: tuple[str, ...] = ()
 
     # incident grouping (collapse related alerts by process lineage, then time)
     incident_tracking: bool = True