Expand TUI guidance and host detection coverage

docs/RUNBOOKS.md

@@ -243,14 +243,18 @@ modules you intentionally trust.
 
 ---
 
-## Runbook 5 — Memory obfuscation or process-hiding library
+## Runbook 5 — Memory obfuscation, process hiding, or injection library
 
-**Triggers:** `memory_obfuscation` (100039), `process_hiding_library` (100048)
+**Triggers:** `memory_obfuscation` (100039), `process_hiding_library` (100048),
+`process_injection_library` (100049)
 
 These alerts come from `/proc/<pid>/maps`. They do not read process memory; they
 flag map shapes associated with encrypted/packed payloads or userland hiding:
 RWX pages, executable anonymous memory, executable `memfd`/deleted mappings, or
-libraries with process-hiding names such as `libhide`.
+libraries with process-hiding names such as `libhide`. They also flag executable
+shared-library mappings from writable/runtime paths such as `/tmp`, `/dev/shm`,
+`/var/tmp`, and `/run/user`, which are common places for injected userland hooks
+or staged `.so` payloads.
 
 **Confirm**
 
@@ -259,6 +263,9 @@ libraries with process-hiding names such as `libhide`.
 - For `process_hiding_library`, check whether the mapped library is package-owned
   and whether it is loaded into tools like `ps`, `pgrep`, `ss`, shells, or admin
   utilities.
+- For `process_injection_library`, preserve the mapped `.so`, check its owner,
+  hash, parent process, and whether it was deliberately loaded by a known
+  profiler, debugger, or local instrumentation tool.
 - For `memory_obfuscation`, distinguish expected JIT runtimes from unknown
   implants. Tune known runtimes with `memory_obfuscation_allow_comms`; use
   `memory_obfuscation_allow_paths` only for well-understood local runtimes or