feat(go): port socket detectors

docs/ROADMAP.md

@@ -260,10 +260,11 @@ Exit criteria:
 - Suricata model assimilation design is complete, and Phase 0's additive
   `enodia.event.v1` Python reference contract is implemented.
 - Phase 1 is in progress under `go-agent/`: a stdlib-only parallel sweep loop,
-  injectable process/file-descriptor state, and the first poll-detector cohort
-  (`ld_preload`, `deleted_exe`, `input_snooper`, `credential_access`) are
-  checked against the Python oracle with a shared fixture. The Go sidecar
-  remains stdout-only and non-production until broader parity lands.
+  injectable process/file-descriptor/socket state, and seven poll detectors
+  (`reverse_shell`, `ld_preload`, `deleted_exe`, `input_snooper`,
+  `credential_access`, `stealth_network`, `egress`) are checked against the
+  Python oracle with a shared fixture. The Go sidecar remains stdout-only and
+  non-production until broader parity lands.
 
 ## Backlog
 

docs/SURICATA_ASSIMILATION.md

@@ -228,8 +228,9 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
   equivalent, poll detectors ported, JSON output matching schemas. Runs
   alongside Python; harness compares both. *In progress:* the isolated
   `go-agent/` sidecar now has stdlib config loading, an injectable `/proc`
-  process/file-descriptor view, the JSONL sweep loop, and fixture parity for
-  `ld_preload`, `deleted_exe`, `input_snooper`, and `credential_access`;
+  process/file-descriptor and `ss` socket view, the JSONL sweep loop, and
+  fixture parity for `reverse_shell`, `ld_preload`, `deleted_exe`,
+  `input_snooper`, `credential_access`, `stealth_network`, and `egress`;
   Python remains the production agent.
 - **Phase 2 — eBPF via `cilium/ebpf`.** Port exec/syscall rules; drop the
   bcc/Python runtime dependency; single static binary.