Add baseline reconciliation: accept audited drift with a reason

Implements the v0.9 roadmap item from the approved design spec. Operators
accept a specific FIM/package/listener/SUID drift item with a mandatory
reason; the ack suppresses that one alert only while the live state still
matches the recorded fingerprint. Content kinds (fim/pkgfile) re-alert on
further change; identity kinds (listener/suid) retire on TTL or revoke.

- reconcile.py: ReconcileStore (mtime-cached, fails closed on missing/corrupt
  store), fingerprint builders, and the filter_alerts chokepoint.
- CLI: baseline accept/revoke/list with --reason/--expires/--force/--stale/--json.
- Wired at the daemon sweep + eBPF chokepoint, fim-check, and /api/integrity.
- RECONCILE_V1 schema, config knob, COMMAND_REFERENCE/SCHEMAS/OPERATIONS/ROADMAP
  docs, and reconcile unit/CLI/integration tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -63,6 +63,13 @@ Implemented investigation/response state:
 - `rules docs` emits generated Markdown rule docs; `docs/RULES.md` is the
   checked-in built-in rule reference with match fields, false positives, and
   drill guidance.
+- `baseline accept/revoke/list` reconciles legitimate FIM/package/listener/SUID
+  drift: an operator accepts an identified item with a mandatory reason, stored
+  fingerprint-bound and audited in `reconciliation.json`. Acks suppress the
+  alert only while live state matches; content kinds (fim/pkgfile) re-alert on
+  further change, identity kinds (listener/suid) retire on TTL or revoke. The
+  filter runs at the daemon chokepoint, `fim-check`, and the dashboard
+  integrity API.
 - IPS behavior is currently explicit workflow: posture hardening plus reviewed
   dry-run containment actions. There is no automatic inline blocking or silent
   host mutation yet.
@@ -70,7 +77,6 @@ Implemented investigation/response state:
 Near-term open work:
 
 - Audited `--apply` response execution with tests and rollback notes.
-- Baseline reconciliation for legitimate FIM/package/listener/SUID drift.
 - Fixture or red-team drill coverage for every built-in SID, including
   event-only and future correlation SIDs.
 - More event sources and correlation across exec, network, persistence, FIM,
@@ -123,6 +129,8 @@ Start with:
   promiscuous interfaces, known LKM rootkit module names, and kernel/module
   taint.
 - `posture.py` performs advisory host hygiene checks.
+- `reconcile.py` owns the acknowledged-drift store and the `filter_alerts`
+  chokepoint that suppresses operator-accepted FIM/package/listener/SUID drift.
 
 ## Current Threat Mapping