feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ

go-agent/internal/snapshot/store.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/assurance"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/correlation"
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/enrich"
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/incident"
@@ -83,6 +84,7 @@ type Store struct {
 	Incidents    *incident.Store
 	LineageDepth int
 	Assurance    *assurance.Chain
+	Integrity    enrich.IntegritySettings
 
 	slowJobs   chan slowJob
 	slowClosed bool
@@ -152,6 +154,21 @@ func (s *Store) ConfigureIncidents(enabled bool, window, lineageDepth int) error
 	return nil
 }
 
+// ConfigureIntegrity copies settings for engines main actually attached into
+// retained snapshot metadata. This does not attach an engine or perform
+// collection: `--snapshot-dir` alone must not make default config values look
+// like active FIM/rootcheck managers.
+func (s *Store) ConfigureIntegrity(cfg config.Config, fimActive, rootcheckActive bool) {
+	s.Integrity = enrich.IntegritySettings{
+		FIMEnabled:            fimActive,
+		FIMScanInterval:       cfg.FIMScanInterval,
+		PackageVerifyEnabled:  fimActive && cfg.FIMPackageVerify,
+		PackageVerifyInterval: cfg.FIMPackageVerifyInterval,
+		RootcheckEnabled:      rootcheckActive,
+		RootcheckInterval:     cfg.RootcheckInterval,
+	}
+}
+
 // EnableSlowEnrichment starts one bounded worker. It deliberately never runs
 // package-manager commands: queue saturation or collector failure only leaves
 // fields unknown and can never delay or reject an alert event.
@@ -291,7 +308,7 @@ func (s *Store) applySlowEnrichment(job slowJob) {
 	processes := enrichmentProcesses(report.Processes)
 	paths := enrichmentPaths(report.Enrichment)
 	updates := enrich.CollectSlow(processes, paths, provenance.PackageOwner)
-	updates.Integrity = enrich.IntegrityAnchors(s.Dir)
+	updates.Integrity = enrich.IntegrityAnchors(s.Dir, s.Integrity)
 
 	// All slow I/O has completed. Take the lock only to merge into the newest
 	// same-second report, so a concurrent alert capture never loses evidence.

go-agent/internal/snapshot/store_test.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/assurance"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
 )
 
@@ -182,6 +183,50 @@ func TestSlowEnrichmentAddsBoundedHashAndFileMetadata(t *testing.T) {
 	}
 }
 
+func TestSlowEnrichmentReportsConfiguredIntegrityWithoutRunningIt(t *testing.T) {
+	store, err := New(t.TempDir(), "/unused", 10, 30)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg := config.Default()
+	cfg.FIMPackageVerify = true
+	store.ConfigureIntegrity(cfg, true, true)
+	store.EnableSlowEnrichment()
+	defer store.Close()
+	store.Collect = func(pid int) ProcessDetail { return ProcessDetail{PID: pid, FDs: map[string]string{}} }
+	if _, err := store.CaptureEvent(alertEvent("2026-07-22T10:11:12Z", model.Alert{
+		SID: 1, Severity: "HIGH", Signature: "test", Classtype: "test", Key: "integrity", Detail: "test", PIDs: []int{42},
+	})); err != nil {
+		t.Fatal(err)
+	}
+	store.FlushSlow()
+	report, err := LoadReport(filepath.Join(store.Dir, "alert-20260722-101112.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	integrity, ok := report.Enrichment["integrity"].(map[string]any)
+	if !ok {
+		t.Fatalf("integrity=%#v", report.Enrichment["integrity"])
+	}
+	if integrity["package_verify"].(map[string]any)["enabled"] != true ||
+		integrity["rootcheck"].(map[string]any)["enabled"] != true {
+		t.Fatalf("integrity=%#v", integrity)
+	}
+}
+
+func TestConfigureIntegrityDoesNotReportUnattachedManagers(t *testing.T) {
+	store, err := New(t.TempDir(), "/unused", 10, 30)
+	if err != nil {
+		t.Fatal(err)
+	}
+	cfg := config.Default()
+	cfg.FIMPackageVerify = true
+	store.ConfigureIntegrity(cfg, false, false)
+	if store.Integrity.FIMEnabled || store.Integrity.PackageVerifyEnabled || store.Integrity.RootcheckEnabled {
+		t.Fatalf("inactive managers reported as configured: %#v", store.Integrity)
+	}
+}
+
 func TestRetentionPrunesCountAndAgeAsPairs(t *testing.T) {
 	store, err := New(t.TempDir(), "/unused", 2, 1)
 	if err != nil {