feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ

CLAUDE.md

@@ -24,18 +24,23 @@ Primary functions:
 
 ## Current State Snapshot
 
-As of 2026-07-04, the project is a local-first Linux IDS/IPS/EDR agent at
+As of 2026-07-24, the project is a local-first Linux IDS/IPS/EDR agent at
 package version `0.7.0`. The branch has a working stdlib-only daemon, CLI,
 HTTPS management console, incident model, response planner, rootcheck, posture
 checks, file/package integrity checks, push notification backends, and optional
 bcc/eBPF telemetry.
 
-An experimental, non-installing Phase 1 Go sidecar now lives under `go-agent/`.
-It is stdlib-only, emits `enodia.event.v1` JSONL, captures an injectable process
-file-descriptor, and socket view, and currently ports `reverse_shell`,
-`ld_preload`, `deleted_exe`, `input_snooper`, `credential_access`,
-`stealth_network`, and `egress`. Python remains the production agent and parity
-oracle; do not describe the Go path as a replacement yet.
+An experimental, non-installing Go sidecar now lives under `go-agent/`. It is
+stdlib-only, emits `enodia.event.v1` JSONL, and ports all current Python poll
+detectors, the exec/syscall/typed-host rule engines, opt-in `cilium/ebpf` exec
+and syscall sources, hot-path plus asynchronous enrichment, and Python-schema-
+compatible incidents/snapshots/hash-chain. A `--state-dir`-gated set of
+sidecar-only integrity engines (FIM, package-DB anchor, rootcheck) now also
+runs asynchronously off the sweep loop. Python's dashboard has an opt-in,
+explicitly read-only `/api/go-sidecar/*` consumer (`go_sidecar_state_dir`, the
+Sidecar tab) that displays this evidence without starting, stopping, or
+otherwise controlling the Go process. Python remains the production agent and
+parity oracle; do not describe the Go path as a replacement yet.
 
 Implemented detection coverage:
 
@@ -63,9 +68,13 @@ Implemented investigation/response state:
 - The dashboard is HTTPS-only, token-protected off loopback, and read-only. It
   shows status, incidents, timelines, alerts, posture findings,
   integrity/watchdog state, event-rule metadata, event tail, dry-run response
-  plans, and a local Settings menu with persistent themes. Web tests cover the
-  theme registry, integrity console wiring, and core text/status contrast
-  checks.
+  plans, and a local Settings menu with persistent themes. An opt-in Sidecar
+  tab additionally displays the isolated Go migration-sidecar's retained
+  heartbeat, alerts, incidents, and event log when `go_sidecar_state_dir` is
+  configured; this consumer is schema-checked and read-only, and never starts,
+  stops, or controls the Go process. Web tests cover the theme registry,
+  integrity console wiring, sidecar consumer isolation, and core text/status
+  contrast checks.
 - `respond plan <incident-id>` builds read-only containment/recovery plans,
   persists CLI-generated plans under `response-plans/`, and appends
   `response-audit.log`. Dashboard/API plan previews do not write artifacts.
@@ -164,9 +173,11 @@ Start with:
   GUI-free presentation model over `tui.collect_model`; only `gui/app.py`
   (tkinter) and `gui/qt_app.py` (PySide6, `[qt]` extra) import GUI libraries,
   enforced by import-guard tests.
-- `go-agent/` is the isolated Phase 1 sidecar with Go config, process-state,
-  detector, schema, and sweep-loop packages. It writes JSONL to stdout and
-  must not share or mutate Python daemon state during parity development.
+- `go-agent/` is the isolated sidecar with Go config, process-state, detector,
+  schema, and sweep-loop packages, plus `fim/`, `pkgdb/`, and `rootcheck/`
+  sidecar-only integrity engines. It writes JSONL to stdout (or a private
+  retained tree under `--state-dir`) and must not share or mutate Python
+  daemon state during parity development.
 
 ## Current Threat Mapping