feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ

go-agent/internal/fim/manager.go

@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package fim
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+const (
+	baselineFilename = "fim-baseline.json"
+	pacmanTimeout    = 10 * time.Minute
+)
+
+// Manager owns the deliberately separate, slow integrity work. Its scans run
+// in at most one goroutine per engine and only hand completed alerts back to
+// the polling loop. That keeps filesystem hashing and pacman from holding a
+// detector, snapshot, or event-output lock.
+type Manager struct {
+	Config config.Config
+	Now    func() time.Time
+	Scan   func([]string) map[string]Entry
+	Verify func(context.Context) (string, error)
+
+	mu            sync.Mutex
+	baseline      map[string]Entry
+	initialized   bool
+	lastScan      time.Time
+	lastVerify    time.Time
+	scanRunning   bool
+	verifyRunning bool
+	pendingAlerts []model.Alert
+}
+
+// New builds a manager with real host collection. Tests replace Scan or Verify
+// so they never read the host or execute a package manager.
+func New(cfg config.Config) *Manager {
+	return &Manager{
+		Config: cfg,
+		Now:    time.Now,
+		Scan:   ScanPaths,
+		Verify: PacmanVerify,
+	}
+}
+
+// Initialize loads a valid non-empty baseline or builds it once. Like Python,
+// baseline creation is a local operator-state action: regular scans never
+// silently accept a changed file as the new truth. The caller supplies LogDir
+// only in explicit sidecar mode, so this baseline can never share or rewrite
+// the Python service's production state.
+func (m *Manager) Initialize() error {
+	if !m.Config.FIMEnabled {
+		return nil
+	}
+	m.mu.Lock()
+	if m.initialized {
+		m.mu.Unlock()
+		return nil
+	}
+	m.mu.Unlock()
+
+	if err := os.MkdirAll(m.Config.LogDir, 0o750); err != nil {
+		return err
+	}
+	baseline := loadBaseline(filepath.Join(m.Config.LogDir, baselineFilename))
+	if len(baseline) == 0 {
+		// A missing, unreadable, malformed, or empty baseline has no trustworthy
+		// historical truth. Rebuilding it is safer than treating every file as a
+		// change, and it happens only during initialization—not a later scan.
+		baseline = m.Scan(PathList(m.Config.FIMPaths))
+		if err := writeBaseline(filepath.Join(m.Config.LogDir, baselineFilename), baseline); err != nil {
+			return err
+		}
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if !m.initialized {
+		m.baseline = baseline
+		m.initialized = true
+	}
+	return nil
+}
+
+// MaybeStart schedules due work and returns immediately. A short interval does
+// not start overlapping scans, which bounds both disk pressure and pacman
+// process count even if a scan takes longer than the configured cadence.
+func (m *Manager) MaybeStart(now time.Time) {
+	if !m.Config.FIMEnabled {
+		return
+	}
+	m.mu.Lock()
+	if !m.initialized {
+		m.mu.Unlock()
+		return
+	}
+	if !m.scanRunning && (m.lastScan.IsZero() || now.Sub(m.lastScan) >= m.Config.FIMScanInterval) {
+		m.scanRunning = true
+		m.lastScan = now
+		// Copy state while protected, then release the mutex before filesystem
+		// I/O. Holding the lock through hashing would block Drain and could make
+		// regular detector sweeps wait behind a large tree.
+		baseline := cloneEntries(m.baseline)
+		paths := append([]string(nil), PathList(m.Config.FIMPaths)...)
+		go m.runScan(baseline, paths)
+	}
+	if m.Config.FIMPackageVerify && !m.verifyRunning &&
+		(m.lastVerify.IsZero() || now.Sub(m.lastVerify) >= m.Config.FIMPackageVerifyInterval) {
+		m.verifyRunning = true
+		m.lastVerify = now
+		go m.runVerify()
+	}
+	m.mu.Unlock()
+}
+
+func (m *Manager) runScan(baseline map[string]Entry, paths []string) {
+	// The baseline intentionally remains immutable after initialization. A
+	// completed scan reports drift; it never turns observed drift into truth.
+	alerts := DiffAlerts(Diff(baseline, m.Scan(paths)))
+	m.mu.Lock()
+	m.pendingAlerts = append(m.pendingAlerts, alerts...)
+	m.scanRunning = false
+	m.mu.Unlock()
+}
+
+func (m *Manager) runVerify() {
+	// pacman can block on its database or a slow disk. Its own deadline keeps
+	// the optional verification feature from accumulating background workers.
+	ctx, cancel := context.WithTimeout(context.Background(), pacmanTimeout)
+	defer cancel()
+	alerts := VerifyAlerts(func() (string, error) { return m.Verify(ctx) })
+	m.mu.Lock()
+	m.pendingAlerts = append(m.pendingAlerts, alerts...)
+	m.verifyRunning = false
+	m.mu.Unlock()
+}
+
+// Drain returns completed background results once. The caller must route them
+// through the shared Agent cooldown and snapshot paths before exposing them.
+func (m *Manager) Drain() []model.Alert {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	alerts := append([]model.Alert(nil), m.pendingAlerts...)
+	m.pendingAlerts = nil
+	return alerts
+}
+
+func loadBaseline(path string) map[string]Entry {
+	entries := make(map[string]Entry)
+	raw, err := os.ReadFile(path)
+	if err != nil || json.Unmarshal(raw, &entries) != nil {
+		return map[string]Entry{}
+	}
+	return entries
+}
+
+func writeBaseline(path string, entries map[string]Entry) error {
+	raw, err := json.Marshal(entries)
+	if err != nil {
+		return err
+	}
+	raw = append(raw, '\n')
+	// Write and rename in the same directory so a crash cannot leave a partly
+	// written JSON file at the baseline path. The restrictive mode keeps hashes
+	// and file metadata from becoming world-readable state.
+	temporary := path + ".tmp"
+	if err := os.WriteFile(temporary, raw, 0o640); err != nil {
+		return err
+	}
+	if err := os.Rename(temporary, path); err != nil {
+		return err
+	}
+	return os.Chmod(path, 0o640)
+}
+
+func cloneEntries(source map[string]Entry) map[string]Entry {
+	result := make(map[string]Entry, len(source))
+	for path, entry := range source {
+		result[path] = entry
+	}
+	return result
+}