feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ

go-agent/internal/config/config.go

@@ -53,11 +53,25 @@ var defaultMemoryObfuscationAllowComms = []string{
 // Config mirrors the Phase 1 settings consumed by the Go sweep loop. More
 // fields are added as their detectors are ported.
 type Config struct {
-	SampleInterval                time.Duration
-	Cooldown                      time.Duration
-	BaselineGrace                 time.Duration
-	SUIDRefresh                   time.Duration
-	SUIDScanInterval              time.Duration
+	SampleInterval   time.Duration
+	Cooldown         time.Duration
+	BaselineGrace    time.Duration
+	SUIDRefresh      time.Duration
+	SUIDScanInterval time.Duration
+	// Integrity engines are parsed with the shared configuration for parity,
+	// but main attaches them only to an explicitly stateful Go sidecar. That
+	// preserves Python's production baselines and management authority.
+	FIMEnabled                    bool
+	FIMPaths                      []string
+	FIMScanInterval               time.Duration
+	FIMPackageVerify              bool
+	FIMPackageVerifyInterval      time.Duration
+	PackageDBVerify               bool
+	PackageDBInterval             time.Duration
+	RootcheckEnabled              bool
+	RootcheckInterval             time.Duration
+	RootcheckPIDCap               int
+	RootcheckModuleAllow          map[string]bool
 	HeartbeatMaxAge               int
 	MaxSnapshots                  int
 	MaxSnapshotAgeDays            int
@@ -97,6 +111,17 @@ func Default() Config {
 		BaselineGrace:                 10 * time.Second,
 		SUIDRefresh:                   time.Hour,
 		SUIDScanInterval:              time.Minute,
+		FIMEnabled:                    true,
+		FIMPaths:                      []string{},
+		FIMScanInterval:               5 * time.Minute,
+		FIMPackageVerify:              false,
+		FIMPackageVerifyInterval:      6 * time.Hour,
+		PackageDBVerify:               true,
+		PackageDBInterval:             10 * time.Minute,
+		RootcheckEnabled:              true,
+		RootcheckInterval:             5 * time.Minute,
+		RootcheckPIDCap:               65536,
+		RootcheckModuleAllow:          map[string]bool{},
 		HeartbeatMaxAge:               120,
 		MaxSnapshots:                  300,
 		MaxSnapshotAgeDays:            60,
@@ -192,6 +217,72 @@ func Load(path string) (Config, error) {
 				return Config{}, fmt.Errorf("suid_scan_interval: %w", err)
 			}
 			cfg.SUIDScanInterval = duration
+		case "fim_enabled":
+			enabled, err := boolean(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("fim_enabled: %w", err)
+			}
+			cfg.FIMEnabled = enabled
+		case "fim_paths":
+			paths, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("fim_paths: %w", err)
+			}
+			cfg.FIMPaths = paths
+		case "fim_scan_interval":
+			duration, err := positiveSeconds(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("fim_scan_interval: %w", err)
+			}
+			cfg.FIMScanInterval = duration
+		case "fim_pkg_verify":
+			enabled, err := boolean(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("fim_pkg_verify: %w", err)
+			}
+			cfg.FIMPackageVerify = enabled
+		case "fim_pkg_verify_interval":
+			duration, err := positiveSeconds(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("fim_pkg_verify_interval: %w", err)
+			}
+			cfg.FIMPackageVerifyInterval = duration
+		case "pkgdb_verify":
+			enabled, err := boolean(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("pkgdb_verify: %w", err)
+			}
+			cfg.PackageDBVerify = enabled
+		case "pkgdb_interval":
+			duration, err := positiveSeconds(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("pkgdb_interval: %w", err)
+			}
+			cfg.PackageDBInterval = duration
+		case "rootcheck_enabled":
+			enabled, err := boolean(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("rootcheck_enabled: %w", err)
+			}
+			cfg.RootcheckEnabled = enabled
+		case "rootcheck_interval":
+			duration, err := positiveSeconds(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("rootcheck_interval: %w", err)
+			}
+			cfg.RootcheckInterval = duration
+		case "rootcheck_pid_cap":
+			cap, err := nonNegativeInt(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("rootcheck_pid_cap: %w", err)
+			}
+			cfg.RootcheckPIDCap = cap
+		case "rootcheck_module_allow":
+			modules, err := stringArray(value)
+			if err != nil {
+				return Config{}, fmt.Errorf("rootcheck_module_allow: %w", err)
+			}
+			cfg.RootcheckModuleAllow = stringSet(modules)
 		case "heartbeat_max_age":
 			age, err := strconv.Atoi(value)
 			if err != nil || age < 0 {