Add platform docs; reposition as host security platform

Add docs/ (SPECIFICATION, ROADMAP, OPERATIONS, COMMAND_REFERENCE,
THREAT_MODEL) describing the current v0.7 agent and the phased path from
local HIDS to a host security platform. Reframe README, package metadata,
and CLI/module descriptions from "intrusion-detection daemon" to "Linux
host security platform", and surface the v0.7 signed-package verify
(pkgdb_pkgverify*) and anti-rootkit (rootcheck_*) knobs in the sample
config. Also wrap the pacman.conf read in pkgdb.siglevel_alert in a
context manager to avoid a leaked file handle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -1,14 +1,41 @@
 # Enodia Sentinel
 
-A host intrusion-detection daemon for Linux. It continuously runs a set of
-detectors over live system state — processes, sockets, file descriptors, the
-SUID inventory, and sensitive files — and writes a detailed forensic snapshot
-(text **and** JSON) with incident-response guidance the moment a known attack
-signature appears.
+A Linux host security platform: intrusion detection, file/package integrity,
+anti-rootkit cross-checks, tamper-evidence, forensic snapshots, push alerts, and
+a read-only operator console.
+
+The current daemon continuously runs detectors over live system state —
+processes, sockets, file descriptors, the SUID inventory, sensitive files, the
+package database, and rootkit-hiding artifacts — then writes a detailed forensic
+snapshot (text **and** JSON) with incident-response guidance the moment a known
+attack signature appears.
 
 Think of it as the security counterpart to a performance watchdog: instead of
 "I/O pressure spiked, here's the kernel state," it's *"a shell just wired itself
-to a socket — here's the process tree, the peer, and what to do about it."*
+to a socket — here's the process tree, the peer, what changed on disk, whether
+the package database was tampered with, and what to do next."*
+
+## Product direction
+
+Enodia is becoming more than an IDS. The local detector is the first layer of a
+broader host security platform:
+
+| Function | Current capability | Direction |
+|---|---|---|
+| Detect | Poll detectors + eBPF exec rules | More event sources and correlation |
+| Verify | FIM, package DB anchor, signed-package checks | External anchors and signed evidence |
+| Investigate | Text/JSON snapshots, dashboard, triage | Incident timelines and evidence export |
+| Respond | Human guidance today | Dry-run response plans and audited containment |
+| Assure | Heartbeat, watchdog, self-integrity, rootcheck | Fleet health and attestation-ready anchors |
+
+Project docs:
+
+- [Specification](docs/SPECIFICATION.md) — product model, current scope, target
+  platform shape, data model, and acceptance criteria.
+- [Roadmap](docs/ROADMAP.md) — phased work from local sensor to incident,
+  response, fleet, and assurance layers.
+- [Operations guide](docs/OPERATIONS.md) — install checks, health checks, alert
+  workflow, baseline hygiene, and evidence export.
 
 > **Two implementations, on purpose.** The project began as a bash prototype
 > (`src/sentinel.sh`, kept as the regression **oracle**) and was re-architected
@@ -131,9 +158,8 @@ sudo tail -f /var/log/enodia-sentinel/events.log
 sentinel-redteam          # safe, self-cleaning attack simulations
 ```
 
-You'll watch the drills trip `reverse_shell`, `ld_preload`, `deleted_exe`,
-`new_listener`, and `new_suid` in real time, each producing a `.log` + `.json`
-snapshot with response guidance.
+You'll watch the drills trip the core poll signatures in real time, each
+producing a `.log` + `.json` snapshot with response guidance.
 
 Output lives in `/var/log/enodia-sentinel/`:
 - `events.log` — one line per alert
@@ -170,7 +196,7 @@ drill only sets the env var on a throwaway process.
 ## Testing
 
 ```bash
-make test          # 25 unit tests, stdlib unittest, no deps
+make test          # stdlib unittest suite, no runtime deps
 ```
 
 Detectors are pure functions over an injectable `SystemState`, so tests build
@@ -442,16 +468,11 @@ conscious tradeoff documented in the file itself.
 
 ## Roadmap
 
-1. **bpftrace tracepoints (optional)** — `capture_execve_bpftrace = true` adds a
-   live `execve` trace to each snapshot.
-2. ✅ **Event-driven `execve` detection (done)** — a real eBPF probe via bcc,
-   feeding a Snort-style rule engine, so a short-lived process can't slip
-   between sweeps.
-3. **More event sources** — `tcp_connect` (event-driven egress) and
-   `security_bprm_check` (LSM) probes, plus per-process lineage tracking.
-4. **A libbpf + CO-RE agent (Go or Rust)** — the production EDR core: ring-buffer
-   event streaming, tamper resistance, no runtime compiler.
+The short version: Enodia grows from local HIDS into a host security platform:
+incident grouping, posture checks, response planning, richer eBPF telemetry,
+fleet health, external anchors, and eventually attestation-ready assurance.
 
+See [docs/ROADMAP.md](docs/ROADMAP.md) for the release tracks and phased plan.
 The polling daemon isn't throwaway — it's the **oracle**: every signature is a
 test case the event layer must reproduce, and `sentinel-redteam` is the shared
 regression suite for both.