feat(go): port socket detectors

docs/SURICATA_ASSIMILATION.md

@@ -228,8 +228,9 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
   equivalent, poll detectors ported, JSON output matching schemas. Runs
   alongside Python; harness compares both. *In progress:* the isolated
   `go-agent/` sidecar now has stdlib config loading, an injectable `/proc`
-  process/file-descriptor view, the JSONL sweep loop, and fixture parity for
-  `ld_preload`, `deleted_exe`, `input_snooper`, and `credential_access`;
+  process/file-descriptor and `ss` socket view, the JSONL sweep loop, and
+  fixture parity for `reverse_shell`, `ld_preload`, `deleted_exe`,
+  `input_snooper`, `credential_access`, `stealth_network`, and `egress`;
   Python remains the production agent.
 - **Phase 2 — eBPF via `cilium/ebpf`.** Port exec/syscall rules; drop the
   bcc/Python runtime dependency; single static binary.