Add baseline reconciliation: accept audited drift with a reason

Implements the v0.9 roadmap item from the approved design spec. Operators
accept a specific FIM/package/listener/SUID drift item with a mandatory
reason; the ack suppresses that one alert only while the live state still
matches the recorded fingerprint. Content kinds (fim/pkgfile) re-alert on
further change; identity kinds (listener/suid) retire on TTL or revoke.

- reconcile.py: ReconcileStore (mtime-cached, fails closed on missing/corrupt
  store), fingerprint builders, and the filter_alerts chokepoint.
- CLI: baseline accept/revoke/list with --reason/--expires/--force/--stale/--json.
- Wired at the daemon sweep + eBPF chokepoint, fim-check, and /api/integrity.
- RECONCILE_V1 schema, config knob, COMMAND_REFERENCE/SCHEMAS/OPERATIONS/ROADMAP
  docs, and reconcile unit/CLI/integration tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

config/enodia-sentinel.toml

@@ -168,6 +168,12 @@ exec_rules_file = ""
 # Add a 3s bpftrace execve trace to each snapshot (requires the bpftrace pkg).
 capture_execve_bpftrace = false
 
+# --- baseline reconciliation ---------------------------------------------
+# Store for acknowledged drift accepted via `baseline accept` (FIM/package/
+# listener/SUID). Each ack is fingerprint-bound and audited; content kinds
+# re-alert if the file changes again. Empty = log_dir/reconciliation.json.
+reconcile_store = ""
+
 # --- retention -----------------------------------------------------------
 max_snapshots = 300         # auto-delete oldest beyond this count (0 = no cap)
 max_snapshot_age_days = 60  # auto-delete older than this (0 = no age cap)