feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ

docs/SURICATA_ASSIMILATION.md

@@ -251,9 +251,13 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
   transports. Bounded `enodia.alert.snapshot.v1` JSON/text pairs now retain
   alerts with basic process context and feed truthful status counts. An atomic
   `enodia.incident.v1` index supplies lineage/time grouping, snapshot IDs, and
-  correlation evidence. Rich enrichment/assurance, management-consumer
-  integration, and broader parity must land before the bcc/Python runtime
-  dependency can be dropped.
+  correlation evidence. Hot-path plus asynchronous enrichment (hashes, file
+  metadata, package ownership) now populate snapshots, and sidecar-only,
+  `--state-dir`-gated FIM, package-DB-anchor, and rootcheck integrity engines
+  now run asynchronously off the sweep loop. Python's dashboard has a first
+  read-only management-console consumer (`go_sidecar_state_dir`,
+  `/api/go-sidecar/*`) over this isolated evidence. Broader Phase 3 rule-engine
+  parity must land before the bcc/Python runtime dependency can be dropped.
 - **Phase 3 — Rule-engine parity + assimilation.** `rev`/`reference`/`metadata`,
   statebits (flowbits), thresholding, suppression, and — if rule count warrants
   — the MPM prefilter. `rules list/show/test/docs` parity.