feat(go): report integrity anchor context

docs/GO_PORT_HANDOFF.md

@@ -1,8 +1,8 @@
 # Go Port Handoff
 
-Saved: 2026-07-22T02:48:00-07:00
+Saved: 2026-07-22T03:00:00-07:00
 Branch: `main`
-Base commit: `6355fb4` (`feat(go): expose retained incident views`)
+Base commit: `88d7a6e` (`feat(go): enrich snapshots with package ownership`)
 Status: implemented and green, but uncommitted
 
 ## Worktree warning
@@ -12,8 +12,8 @@ continuations. Do not reset, clean, or broadly restage it.
 
 - The validation-sidecar, incident-persistence, bounded-enrichment, local-
   assurance, asynchronous-enrichment, and incident-reader tranches are signed
-  commits `f85c2e8`, `538d1d9`, `fd2bbba`, `1ab4add`, `eff31b3`, and
-  `6355fb4`. The package-ownership enrichment slice is uncommitted.
+  commits `f85c2e8`, `538d1d9`, `fd2bbba`, `1ab4add`, `eff31b3`, `6355fb4`,
+  and `88d7a6e`. The integrity-anchor enrichment slice is uncommitted.
 - At this checkpoint, `git status --short` has 20 entries with untracked
   directories collapsed.
 - The Python GUI files and tests are separate pre-existing work. Preserve them
@@ -106,7 +106,10 @@ static binary.
 - The asynchronous worker now resolves pacman/dpkg/rpm package-owner strings
   with a two-second bound and cache; ownership lookup never holds a detector
   lock or blocks alert capture.
-- Richer integrity anchors and notification fan-out are not yet ported.
+- The worker now reports FIM-baseline, package-DB-anchor, and Go hash-chain
+  presence/age. It explicitly marks package verification and rootcheck disabled
+  until their actual engines are ported.
+- Richer integrity engines and notification fan-out are not yet ported.
 - `--incidents-list` and `--incident-show <id>` now read the sidecar's isolated
   state without starting the agent. The latter returns `enodia.incident.view.v1`
   with the incident, available snapshots, and time-ordered timeline.
@@ -154,8 +157,9 @@ the suite still exits successfully.
 
 ## Resume here
 
-1. Add bounded integrity-anchor collectors to the existing asynchronous worker
-   without destructive response behavior.
+1. Port the actual FIM/package-verification/rootcheck engines behind explicit,
+   bounded acceptance gates; do not treat enrichment anchor status as detection
+   parity.
 2. Add a read-only management API consumer for isolated Go snapshot/event state
    while keeping Python authoritative.
 3. Continue broader Phase 3 rule metadata/state parity before considering any