Add incident grouping (roadmap v0.8: incident list/show/export)

Collapse related alerts into one incident, process-lineage first with a
time-window fallback. Each alert batch's flagged PIDs are walked up the
/proc PPid chain into a lineage set (excluding pid 0/1 so everything
doesn't correlate through init); batches whose lineage sets intersect —
sharing a process or a common ancestor like the web server or SSH
session — join the same incident. PID-less batches (FIM drift, package
tamper, hidden modules) fall back to the most recently active open
incident within incident_window.

snapshot.capture now computes lineage and records each snapshot into a
JSON incident index (incidents.json), writing incident_id into both the
report JSON (report level, so the per-alert schema is untouched) and the
text header. New commands:

  incident list              incidents newest-first, with signatures
  incident show <id>         summary + time-ordered snapshot timeline
  incident export <id>       JSON bundle: record + inlined snapshots

The lineage/assign cores are pure functions; record() serializes the
index under a lock (capture runs from sweep + eBPF threads) and is
best-effort so an index problem never loses a snapshot. 17 new tests
(lineage, assign, record, and an end-to-end capture→group→CLI path).
Config: incident_tracking / incident_window / incident_lineage_depth.
Docs + sample config updated; closes the last v0.8 roadmap item.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/config.py

@@ -83,6 +83,11 @@ class Config:
     rootcheck_interval: int = 300            # seconds between cross-view sweeps
     rootcheck_pid_cap: int = 65536           # upper PID to brute-force via kill(0)
 
+    # incident grouping (collapse related alerts by process lineage, then time)
+    incident_tracking: bool = True
+    incident_window: int = 1800              # s an incident stays open for new alerts
+    incident_lineage_depth: int = 8          # ancestors walked when correlating
+
     # host posture (config hygiene; advisory, command-driven, never blocks startup)
     posture_sshd_config: str = "/etc/ssh/sshd_config"
     posture_sudoers: str = "/etc/sudoers"