Add baseline reconciliation: accept audited drift with a reason

Implements the v0.9 roadmap item from the approved design spec. Operators
accept a specific FIM/package/listener/SUID drift item with a mandatory
reason; the ack suppresses that one alert only while the live state still
matches the recorded fingerprint. Content kinds (fim/pkgfile) re-alert on
further change; identity kinds (listener/suid) retire on TTL or revoke.

- reconcile.py: ReconcileStore (mtime-cached, fails closed on missing/corrupt
  store), fingerprint builders, and the filter_alerts chokepoint.
- CLI: baseline accept/revoke/list with --reason/--expires/--force/--stale/--json.
- Wired at the daemon sweep + eBPF chokepoint, fim-check, and /api/integrity.
- RECONCILE_V1 schema, config knob, COMMAND_REFERENCE/SCHEMAS/OPERATIONS/ROADMAP
  docs, and reconcile unit/CLI/integration tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/SCHEMAS.md

@@ -147,3 +147,33 @@ Required fields:
 | `apply_supported` | boolean | Whether the plan supports apply. |
 | `action_count` | integer | Number of proposed actions. |
 | `plan_path` | string | Persisted plan artifact path. |
+
+## `enodia.reconcile.v1`
+
+Acknowledged-drift store written by `baseline accept/revoke/list`
+(`log_dir/reconciliation.json`, overridable via `reconcile_store`) and emitted
+by `baseline list --json`.
+
+Top-level fields:
+
+| Field | Type | Meaning |
+|---|---|---|
+| `schema` | string | `enodia.reconcile.v1`. |
+| `records` | array | Acknowledgement records (below). |
+
+Each record:
+
+| Field | Type | Meaning |
+|---|---|---|
+| `kind` | string | `fim`, `pkgfile`, `listener`, or `suid`. |
+| `target` | string | Path, or `port/comm` key for listeners. |
+| `fingerprint` | object | Kind-specific identity compared each sweep. |
+| `reason` | string | Mandatory operator justification. |
+| `actor` | string | Who recorded the acceptance. |
+| `accepted_at` | string | ISO-8601 UTC acceptance time. |
+| `status` | string | `ok` or `stale`. |
+| `expires_at` | string | ISO-8601 UTC TTL; absent when no TTL. |
+
+The dashboard `enodia.integrity.v1` payload also carries a `reconciliation`
+summary object (`total`, `ok`, `stale`, `stale_items`) and a `reconciliation`
+entry under `checks`.