feat(go): persist Python-compatible incidents

go-agent/README.md

@@ -46,11 +46,14 @@ Current scope:
 - optional `enodia.alert.snapshot.v1` JSON/text pairs (`--snapshot-dir`) with
   same-second alert batching, best-effort `/proc` context, and Python-compatible
   count/age pruning;
+- Python-compatible `enodia.incident.v1` grouping and atomic `incidents.json`
+  persistence, using process lineage first and the shared time-window fallback,
+  including additive SID `100080` correlation evidence;
 - a shared fixture checked against the Python detector by
   `scripts/check-go-parity.py`.
 
-It does not yet provide Python's incident grouping, rich enrichment, assurance
-chain, or notification fan-out for those snapshots, and it does not replace
+It does not yet provide Python's rich enrichment, assurance chain, notification
+fan-out, or management consumers for those snapshots, and it does not replace
 `enodia-sentinel`. The module requires Go 1.25 or newer; development is currently
 verified with Go 1.26.5. Run a single terminal-visible stateless sweep:
 
@@ -105,10 +108,13 @@ Alert envelopes are also batched into private
 `alert-YYYYMMDD-HHMMSS.{json,log}` pairs under the same isolated directory.
 The JSON side implements the required `enodia.alert.snapshot.v1` fields and the
 service applies shared `max_snapshots` / `max_snapshot_age_days` limits. Status
-counts are populated only from parseable retained snapshots. Enrichment is
-currently limited to a Go-source marker plus best-effort process detail;
-incident indexing and the Python forensic enrichment/assurance pipeline remain
-future parity work.
+counts are populated only from parseable retained snapshots. Each snapshot is
+linked to an incident in a private atomic `incidents.json` index. Grouping uses
+the configured `incident_tracking`, `incident_window`, and
+`incident_lineage_depth` settings; same-second alert batches update one incident
+and one snapshot name idempotently. Enrichment is currently limited to a
+Go-source marker plus best-effort process detail; the Python forensic
+enrichment/assurance and notification pipelines remain future parity work.
 
 After every successfully emitted status record, the service atomically updates
 `/var/lib/enodia-sentinel-go/heartbeat` with the current Unix timestamp (mode