Add platform docs; reposition as host security platform

Add docs/ (SPECIFICATION, ROADMAP, OPERATIONS, COMMAND_REFERENCE,
THREAT_MODEL) describing the current v0.7 agent and the phased path from
local HIDS to a host security platform. Reframe README, package metadata,
and CLI/module descriptions from "intrusion-detection daemon" to "Linux
host security platform", and surface the v0.7 signed-package verify
(pkgdb_pkgverify*) and anti-rootkit (rootcheck_*) knobs in the sample
config. Also wrap the pacman.conf read in pkgdb.siglevel_alert in a
context manager to avoid a leaked file handle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/OPERATIONS.md

@@ -0,0 +1,143 @@
+# Enodia Sentinel Operations Guide
+
+This guide turns the current toolset into repeatable operator workflows. It is
+deliberately practical: what to run, what to expect, and what to check next.
+
+## First Install Checklist
+
+1. Install and enable the service.
+
+   ```bash
+   sudo make install
+   sudo make enable
+   ```
+
+2. Build the listener and SUID baselines.
+
+   ```bash
+   sudo enodia-sentinel baseline
+   ```
+
+3. Build the FIM baseline.
+
+   ```bash
+   sudo enodia-sentinel fim-baseline
+   ```
+
+4. Run a one-shot check.
+
+   ```bash
+   sudo enodia-sentinel check
+   sudo enodia-sentinel rootcheck
+   sudo enodia-sentinel pkgdb-check
+   ```
+
+5. Start the dashboard if desired.
+
+   ```bash
+   sudo systemctl enable --now enodia-sentinel-web
+   ```
+
+6. Configure one off-box notification or watchdog path. A local-only alerting
+   path is not enough if the whole host goes silent.
+
+## Routine Health Checks
+
+Run these after upgrades, config edits, or suspicious behavior:
+
+```bash
+enodia-sentinel check
+enodia-sentinel fim-check
+enodia-sentinel pkgdb-check
+enodia-sentinel pkgdb-verify --sample 100
+enodia-sentinel rootcheck
+enodia-sentinel triage
+```
+
+Expected healthy output:
+
+- `check`: no alerts, or only expected tuned findings.
+- `fim-check`: no changes against baseline after legitimate updates have been
+  acknowledged.
+- `pkgdb-check`: package DB consistent with anchor.
+- `pkgdb-verify`: sampled files match signed cache packages.
+- `rootcheck`: no hidden processes, modules, ports, or sniffers.
+
+## Alert Workflow
+
+When Sentinel fires:
+
+1. Open the newest JSON and text snapshots in `/var/log/enodia-sentinel`.
+2. Identify the signature, `sid`, affected PIDs, executable paths, remote peers,
+   and parent process.
+3. Run `enodia-sentinel triage` to separate known benign listener noise from
+   findings that need review.
+4. If the alert involves a binary, run:
+
+   ```bash
+   enodia-sentinel fim-check --packages
+   enodia-sentinel pkgdb-verify --sample 200
+   ```
+
+5. If the alert involves hiding or tampering, run:
+
+   ```bash
+   enodia-sentinel rootcheck
+   enodia-sentinel pkgdb-check
+   ```
+
+6. Preserve evidence before changing state:
+
+   ```bash
+   cp -a /var/log/enodia-sentinel /tmp/enodia-sentinel-evidence
+   ```
+
+7. Contain manually for now. Future response commands should produce a dry-run
+   plan first.
+
+## Common Findings
+
+| Finding | First checks |
+|---|---|
+| `reverse_shell` | Inspect parent process, fd table, remote peer, shell argv, and user. |
+| `egress` | Confirm interpreter, destination IP, command line, and parent process. |
+| `new_listener` | Identify owning process and whether the binary is package-owned. |
+| `new_suid` | Check path, owner, package provenance, and whether it lives in a writable directory. |
+| `persistence` | Diff the changed file and identify the modifying package or process if possible. |
+| `fim_modified` | Verify package ownership, package checksum, and whether the change followed an upgrade. |
+| `pkgdb_tamper` | Treat as high-confidence tampering until a legitimate package transaction explains it. |
+| `pkg_signature_mismatch` | Treat as a potentially trojaned package-owned file. |
+| `hidden_*` rootcheck alerts | Compare live tools, preserve evidence, and consider offline analysis. |
+
+## Baseline Hygiene
+
+Baselines are useful only if they represent a known-good state.
+
+- Build baselines after installing Sentinel on a clean host.
+- Rebuild listener/SUID baselines after intentionally adding long-running
+  services or privileged binaries.
+- Use `fim-update` only after confirming changes are legitimate. Package hooks
+  already run it for normal package transactions.
+- Keep a copy of important anchors off-box when possible.
+
+## Suggested Hardening
+
+- Keep the dashboard bound to Tailscale or loopback, not a public interface.
+- Set `web_token` explicitly for fully read-only service operation.
+- Enable at least one push backend.
+- Run `watchdog` from another machine.
+- Consider `chattr +i` for Sentinel binaries, systemd units, config, baselines,
+  and the pacman hook after setup.
+- Keep the package cache populated if using signed-package verification.
+- Do not disable package signature verification.
+
+## Evidence Export
+
+Until the incident command set exists, an evidence bundle is simply:
+
+```bash
+tar -C /var/log -czf /tmp/enodia-sentinel-evidence.tgz enodia-sentinel
+```
+
+That bundle contains events, snapshots, baselines, heartbeat state, package DB
+anchor, and dashboard-readable JSON.