Add file integrity monitoring (Tripwire-style), auto-refreshed via pacman hook

Detects binary/config tampering by content hash — catching a malicious swap
even when mtime is preserved (the gap in mtime-based persistence checks). Two
engines split by file ownership:

- fim.py hash baseline: SHA-256 (+ mode/uid/gid/size) of security-critical
  files the package manager doesn't track (/usr/local, /etc configs, systemd
  units, SSH keys). The baseline refreshes ONLY via fim-update / the pacman
  hook, so a flagged change stays flagged until acknowledged (Tripwire
  semantics). Alerts: fim_modified 100017 / fim_added 100018 / fim_removed 100019.
- package verification: `pacman -Qkk` checks package-owned binaries against the
  distro's own signed checksums — no baseline to maintain, implicitly current
  because the package DB updates on every upgrade. fim_pkg_modified 100020.

Auto-update on system updates: a pacman PostTransaction hook runs
`enodia-sentinel fim-update` after every install/upgrade/remove, so legitimate
package changes never alert — no manual `tripwire --update`.

- daemon: backgrounded FIM scan + optional pkg-verify on slow cadences, feeding
  the normal alert/snapshot/push pipeline; baseline loaded/built at startup
- cli: fim-baseline / fim-update / fim-check [--packages]
- config: fim_enabled, fim_paths, fim_scan_interval, fim_pkg_verify[_interval]
- packaging: ship + install the pacman hook (Makefile + PKGBUILD)
- tests: +7 (hashing, diff incl. mtime-preserving tamper, pacman -Qkk parse).
  72/72 pass. Verified end-to-end: a content swap with preserved mtime is caught.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/daemon.py

@@ -36,6 +36,12 @@ class Sentinel:
         self._suid_thread: threading.Thread | None = None
         self._last_suid_scan = 0.0
         self._last_suid_baseline_refresh = self.start_time
+        # FIM: baseline + background scan state
+        self.fim_baseline: dict = {}
+        self._fim_thread: threading.Thread | None = None
+        self._last_fim_scan = 0.0
+        self._fim_pkg_thread: threading.Thread | None = None
+        self._last_fim_pkg = 0.0
         self._stop = threading.Event()
 
     # -- baselines ---------------------------------------------------------
@@ -82,6 +88,57 @@ class Sentinel:
             self._last_suid_baseline_refresh = time.time()
             self._save(self.cfg.suid_baseline, sorted(self.suid_baseline))
 
+    # -- FIM (off the loop thread) -----------------------------------------
+    def build_fim_baseline(self) -> int:
+        from .fim import scan_paths
+        self.fim_baseline = scan_paths(self.cfg.fim_path_list())
+        self.cfg.log_dir.mkdir(parents=True, exist_ok=True)
+        self.cfg.fim_baseline.write_text(json.dumps(self.fim_baseline))
+        return len(self.fim_baseline)
+
+    def load_fim_baseline(self) -> None:
+        try:
+            self.fim_baseline = json.loads(self.cfg.fim_baseline.read_text())
+        except (OSError, ValueError):
+            self.fim_baseline = {}
+        if not self.fim_baseline:
+            self.build_fim_baseline()
+
+    def _maybe_scan_fim(self, now: float) -> None:
+        if not self.cfg.fim_enabled:
+            return
+        if self._fim_thread and self._fim_thread.is_alive():
+            return
+        if (now - self._last_fim_scan) < self.cfg.fim_scan_interval:
+            return
+        self._last_fim_scan = now
+        self._fim_thread = threading.Thread(target=self._scan_fim, daemon=True)
+        self._fim_thread.start()
+
+    def _scan_fim(self) -> None:
+        from .fim import diff, diff_alerts, scan_paths
+        current = scan_paths(self.cfg.fim_path_list())
+        # NB: the baseline is NOT updated here — only `fim-update` / the pacman
+        # hook refreshes it, so a change stays flagged until acknowledged.
+        for alert in diff_alerts(diff(self.fim_baseline, current)):
+            self._on_exec_alert(alert)
+
+    def _maybe_pkg_verify(self, now: float) -> None:
+        if not self.cfg.fim_pkg_verify:
+            return
+        if self._fim_pkg_thread and self._fim_pkg_thread.is_alive():
+            return
+        if (now - self._last_fim_pkg) < self.cfg.fim_pkg_verify_interval:
+            return
+        self._last_fim_pkg = now
+        self._fim_pkg_thread = threading.Thread(target=self._pkg_verify, daemon=True)
+        self._fim_pkg_thread.start()
+
+    def _pkg_verify(self) -> None:
+        from .fim import pacman_verify_alerts
+        for alert in pacman_verify_alerts():
+            self._on_exec_alert(alert)
+
     # -- one sweep ---------------------------------------------------------
     def sweep(self, *, force_suid: bool = False) -> list[Alert]:
         now = time.time()
@@ -132,6 +189,7 @@ class Sentinel:
         with open(self.cfg.events_log, "a") as fh:
             fh.write(f"{time.strftime('%FT%T%z')} enodia-sentinel started\n")
         self.build_baselines()
+        self.load_fim_baseline()
         snapshot.prune(self.cfg)
         self._start_exec_monitor()
         sweeps = 0
@@ -139,6 +197,8 @@ class Sentinel:
             now = time.time()
             if (now - self.start_time) >= self.cfg.baseline_grace:
                 self._maybe_scan_suid(now)
+                self._maybe_scan_fim(now)
+                self._maybe_pkg_verify(now)
             alerts = self.sweep()
             fresh = self.fresh_alerts(alerts, now)
             if fresh: