Relicense under GPL-3.0-or-later

Replace MIT with the full GNU GPLv3 text, update license metadata in
pyproject.toml (+ trove classifiers) and PKGBUILD, and add
SPDX-License-Identifier headers to all Python modules and shell scripts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """Enodia Sentinel — a host intrusion-detection daemon.
 
 A poll-based HIDS that runs a set of detectors over live system state and

enodia_sentinel/alert.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """Alert and severity types shared by all detectors."""
 from __future__ import annotations
 

enodia_sentinel/cli.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """Command-line entry point.
 
   enodia-sentinel run        # daemon loop (default; used by systemd)

enodia_sentinel/config.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """Runtime configuration.
 
 Defaults live here; overrides come from a TOML file (default

enodia_sentinel/daemon.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """The detection daemon: sweep loop, cooldown dedup, baseline management.
 
 Unlike the bash prototype, all loop state (cooldowns, last-scan timestamps,

enodia_sentinel/detectors/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """Detector registry.
 
 Each detector is a ``Detector`` with a ``name`` and a ``detect(state, cfg)``

enodia_sentinel/detectors/deleted_exe.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """deleted_exe — a process running from a deleted or memfd-backed binary.
 
 Fileless malware unlinks its dropper (or runs straight from ``memfd``) so there

enodia_sentinel/detectors/egress.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """egress — an interpreter holding an outbound connection to a public IP.
 
 C2 beacons and exfil phone home. A scripting interpreter (bash/python/perl/nc…)

enodia_sentinel/detectors/ld_preload.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """ld_preload — userland rootkit / library-injection indicators.
 
 Two signatures:

enodia_sentinel/detectors/new_listener.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """new_listener — a listening socket absent from the startup baseline.
 
 Bind shells and backdoors have to listen somewhere. We diff the current set of

enodia_sentinel/detectors/new_suid.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """new_suid — a SUID/SGID binary that wasn't in the baseline.
 
 A new setuid binary is a privilege-escalation persistence trick; one in a

enodia_sentinel/detectors/persistence.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """persistence — modification of a watched persistence-relevant file.
 
 Persistence has to land somewhere that survives a reboot: cron, systemd units,

enodia_sentinel/detectors/reverse_shell.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """reverse_shell — an interpreter with a network socket on its stdio.
 
 A real reverse shell dups a TCP/UDP socket onto fd 0/1/2 (``nc -e /bin/bash``,

enodia_sentinel/netutil.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """Network address helpers, backed by the stdlib ``ipaddress`` module.
 
 The bash prototype hand-rolled integer/CIDR math; here we lean on ``ipaddress``

enodia_sentinel/snapshot.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """Forensic snapshot writer.
 
 When detections fire, this captures a timestamped report — both a human-readable

enodia_sentinel/system.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """A snapshot of live system state, gathered once per detector sweep.
 
 Detectors read from a single ``SystemState`` instance instead of each shelling