Expand TUI guidance and host detection coverage

docs/ROADMAP.md

@@ -44,7 +44,8 @@ work that is bigger than single alerts.
   raw ICMP/special-protocol rootcheck detection.
 - ✅ Add process-hiding and memory-obfuscation coverage: `/proc` vs `ps`
   cross-view checks plus memory-map scans for hide libraries, RWX memory, and
-  executable anonymous/memfd/deleted mappings.
+  executable anonymous/memfd/deleted mappings, plus writable-path executable
+  library mappings that suggest userland process injection.
 - ✅ Add event-driven memory telemetry for short-lived `mprotect`/`mmap` RWX,
   `memfd_create`, `ptrace`, seccomp, cross-process memory access, and memory
   locking syscalls.
@@ -131,8 +132,11 @@ Purpose: reduce blind spots and connect related signals.
 - ✅ Add the first typed host-event rule family beside exec/syscall rules:
   `rules test` accepts `tcp_connect` event JSON and ships SID `100067` for
   interpreter egress to unusual public ports, with a replayable fixture.
+- ✅ Add a second typed host-event rule family for `listen` events: SID `100068`
+  flags interpreters opening listeners on unusual local ports, with local-port
+  match conditions and a replayable fixture.
 - Continue generalizing the rule engine across more typed host events:
-  `bind`, `listen`, `accept`, `file_write`, `chmod/chown`, `setuid/setgid`,
+  `bind`, `accept`, `file_write`, `chmod/chown`, `setuid/setgid`,
   `capset`, and module-load events.
 - Keep rules declarative and Snort-like:
   `sid`, `msg`, `severity`, `classtype`, `event`, and match fields such as