feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ

go-agent/README.md

@@ -20,6 +20,17 @@ Current scope:
 - an opt-in live baseline lifecycle (`--state-dir`) that builds listener/SUID
   baselines, honors the startup grace gate, scans persistence paths, and
   atomically retains `first-seen.json` using the Python-compatible schema;
+- a sidecar-only FIM engine, enabled only with `--state-dir`, that persists a
+  SHA-256 security-path baseline as `fim-baseline.json`, performs
+  non-overlapping background comparisons, and can opt in to a bounded
+  `pacman -Qkk` package verification pass with `fim_pkg_verify = true`;
+- a sidecar-only rootcheck engine that bounds PID cross-view probing with
+  `rootcheck_pid_cap`, runs one background comparison per interval, and checks
+  procfs, sysfs, `ps`, socket, module-taint, kernel-taint, and promiscuous-mode
+  views without blocking the polling loop;
+- a sidecar-only package-DB anchor (`pkgdb_verify`) that fingerprints pacman's
+  local checksum database and alerts only on changes that lack a corresponding
+  transaction-log record; it never refreshes an unexplained changed anchor;
 - pure exec and syscall event models plus replayable rule engines: built-in
   exec SIDs `100001`–`100004`, configured `[[exec_rules]]`, and syscall SIDs
   `100060`–`100066` now emit Python-identical alert envelopes without requiring
@@ -52,10 +63,12 @@ Current scope:
 - a shared fixture checked against the Python detector by
   `scripts/check-go-parity.py`.
 
-It does not yet provide Python's full enrichment, notification fan-out, or
-management consumers for those snapshots, and it does not replace
-`enodia-sentinel`. The module requires Go 1.25 or newer; development is currently
-verified with Go 1.26.5. Run a single terminal-visible stateless sweep:
+It does not yet provide Python's full enrichment or notification fan-out, and
+it does not replace `enodia-sentinel`. Python's optional `/api/go-sidecar/*`
+consumer can display this sidecar's isolated retained evidence, but remains
+read-only and never starts or controls the Go process. The module requires Go
+1.25 or newer; development is currently verified with Go 1.26.5. Run a single
+terminal-visible stateless sweep:
 
 ```bash
 cd go-agent
@@ -118,10 +131,12 @@ process/parent context, lineage, remote-IP classification, and candidate paths
 from already-captured data without new I/O. A 16-job asynchronous worker then
 adds streamed SHA-256 values for regular executables up to 8 MiB, file metadata,
 and pacman/dpkg/rpm package-owner strings with a two-second query bound;
-saturation leaves fields unknown rather than delaying alerts. Richer integrity
-engines and notifications remain future parity work. The worker does report
-truthful FIM-baseline, package-DB-anchor, and Go hash-chain presence/age while
-explicitly marking unported package verification and rootcheck as disabled.
+saturation leaves fields unknown rather than delaying alerts. The sidecar also
+has separate, bounded FIM/package-verification, package-DB-anchor, and
+rootcheck engines; notification fan-out remains future parity work. The worker
+reports truthful FIM-baseline, package-DB-anchor, and Go hash-chain
+presence/age, plus the configured `pacman -Qkk` and rootcheck cadences. This is
+metadata only: recording a snapshot never starts integrity work.
 Snapshot text/JSON
 revisions append synchronized `enodia.hash_chain.v1`
 records to a private local `hash-chain.jsonl`.