Add baseline reconciliation: accept audited drift with a reason

Implements the v0.9 roadmap item from the approved design spec. Operators
accept a specific FIM/package/listener/SUID drift item with a mandatory
reason; the ack suppresses that one alert only while the live state still
matches the recorded fingerprint. Content kinds (fim/pkgfile) re-alert on
further change; identity kinds (listener/suid) retire on TTL or revoke.

- reconcile.py: ReconcileStore (mtime-cached, fails closed on missing/corrupt
  store), fingerprint builders, and the filter_alerts chokepoint.
- CLI: baseline accept/revoke/list with --reason/--expires/--force/--stale/--json.
- Wired at the daemon sweep + eBPF chokepoint, fim-check, and /api/integrity.
- RECONCILE_V1 schema, config knob, COMMAND_REFERENCE/SCHEMAS/OPERATIONS/ROADMAP
  docs, and reconcile unit/CLI/integration tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -71,8 +71,11 @@ Purpose: move from "tell me" to "help me act" without unsafe automation.
   semantics are designed for pacman, dpkg, and rpm.
 - Require explicit `--apply` for changes; default to read-only plans.
 - Extend response audit logs to any future state-changing `--apply` workflow.
-- Add baseline reconciliation:
-  accept legitimate FIM/package/listener/SUID changes with a recorded reason.
+- ✅ Add baseline reconciliation: accept legitimate FIM/package/listener/SUID
+  drift with a mandatory reason via `baseline accept/revoke/list`. Acks are
+  fingerprint-bound (content kinds re-alert on further change), support an
+  optional TTL, and are filtered at the daemon chokepoint, `fim-check`, and the
+  dashboard integrity API.
 - Add richer false-positive suppression suggestions that can emit TOML snippets
   but never modify config automatically.
 - Add recovery checks: