Add egress drill + sid-verified harness and IR runbooks (roadmap v0.8)

Red-team harness: every detector now has a named drill with an expected
signature/sid, shown by `sentinel-redteam --list`. Add the missing
`egress` drill (the one detector without one) — explicit-only, since it
is the sole drill that emits real outbound traffic. After firing, the
harness runs `enodia-sentinel check` and reports PASS/MISS per poll
detection, turning it into a shared regression check.

Add docs/RUNBOOKS.md: confirm/preserve/contain/recover playbooks for
reverse shells & egress, persistence, trojaned binaries / package
tampering, hidden listeners & rootkits, and sensor tampering — each tied
to the real signatures, sids, and commands. Linked from README and the
OPERATIONS alert workflow.

Both close the remaining smaller v0.8 roadmap items.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -32,10 +32,10 @@ work that is bigger than single alerts.
   package signatures. Still to come: unexpected enabled services and unsafe
   systemd unit settings.
 - ✅ Add a machine-readable `status --json` command for automation.
-- Update the red-team harness so every current detection has a named drill and
-  expected `sid`.
-- Document incident response runbooks for reverse shells, persistence, trojaned
-  binaries, hidden listeners, and sensor tampering.
+- ✅ Update the red-team harness so every current detection has a named drill and
+  expected `sid` (`sentinel-redteam --list`), with a PASS/MISS verification pass.
+- ✅ Document incident response runbooks for reverse shells, persistence, trojaned
+  binaries, hidden listeners, and sensor tampering ([RUNBOOKS.md](RUNBOOKS.md)).
 
 Exit criteria: