Add incident grouping (roadmap v0.8: incident list/show/export)

Collapse related alerts into one incident, process-lineage first with a
time-window fallback. Each alert batch's flagged PIDs are walked up the
/proc PPid chain into a lineage set (excluding pid 0/1 so everything
doesn't correlate through init); batches whose lineage sets intersect —
sharing a process or a common ancestor like the web server or SSH
session — join the same incident. PID-less batches (FIM drift, package
tamper, hidden modules) fall back to the most recently active open
incident within incident_window.

snapshot.capture now computes lineage and records each snapshot into a
JSON incident index (incidents.json), writing incident_id into both the
report JSON (report level, so the per-alert schema is untouched) and the
text header. New commands:

  incident list              incidents newest-first, with signatures
  incident show <id>         summary + time-ordered snapshot timeline
  incident export <id>       JSON bundle: record + inlined snapshots

The lineage/assign cores are pure functions; record() serializes the
index under a lock (capture runs from sweep + eBPF threads) and is
best-effort so an index problem never loses a snapshot. 17 new tests
(lineage, assign, record, and an end-to-end capture→group→CLI path).
Config: incident_tracking / incident_window / incident_lineage_depth.
Docs + sample config updated; closes the last v0.8 roadmap item.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -20,12 +20,13 @@ promised here; the sequence matters more than calendar precision.
 Purpose: make the current agent easier to operate and create the data model for
 work that is bigger than single alerts.
 
-- Add `incident_id` grouping around related alerts while preserving existing
-  alert JSON.
-- Add an incident timeline generator:
-  alert time, process ancestry, sockets, persistence writes, FIM diffs, package
-  transactions, and rootcheck findings.
-- Add `enodia-sentinel incident list/show/export`.
+- ✅ Add `incident_id` grouping around related alerts (process-lineage first,
+  time-window fallback) while preserving the existing alert JSON — `incident_id`
+  is added at snapshot-report level.
+- ✅ Add an incident timeline generator: `incident show` builds a time-ordered
+  view across an incident's member snapshots (time, severity, signatures, PIDs).
+  Richer sources (package transactions, dedicated FIM-diff lines) can follow.
+- ✅ Add `enodia-sentinel incident list/show/export`.
 - ✅ Add host posture checks (`enodia-sentinel posture check`):
   SSH root/password/empty-password login, passwordless and writable sudoers,
   world-writable PATH components, loose sensitive-file permissions, and disabled