feat(go): add Phase 1 parity sidecar

CLAUDE.md

@@ -30,6 +30,11 @@ HTTPS management console, incident model, response planner, rootcheck, posture
 checks, file/package integrity checks, push notification backends, and optional
 bcc/eBPF telemetry.
 
+An experimental, non-installing Phase 1 Go sidecar now lives under `go-agent/`.
+It is stdlib-only, emits `enodia.event.v1` JSONL, captures an injectable process
+view, and ports only `deleted_exe` so far. Python remains the production agent
+and parity oracle; do not describe the Go path as a replacement yet.
+
 Implemented detection coverage:
 
 - Poll detectors: `reverse_shell`, `ld_preload`, `deleted_exe`,
@@ -149,6 +154,9 @@ Start with:
 - `tray/` is the optional desktop tray frontend over the CLI and systemctl;
   only `tray/app.py` may import `pystray`/`PIL` (enforced by an import-guard
   test).
+- `go-agent/` is the isolated Phase 1 sidecar with Go config, process-state,
+  detector, schema, and sweep-loop packages. It writes JSONL to stdout and
+  must not share or mutate Python daemon state during parity development.
 
 ## Current Threat Mapping
 
@@ -176,6 +184,8 @@ python3 -m enodia_sentinel.cli incident list
 python3 -m enodia_sentinel.cli respond plan <incident-id> --json
 python3 -m enodia_sentinel.cli rules list
 python3 -m enodia_sentinel.cli web
+make test-go
+make parity-go
 ```
 
 The web dashboard is HTTPS-only. In development it auto-generates a self-signed
@@ -190,6 +200,8 @@ certificate.
   `/sys`, or `ss`.
 - Web tests bind a local HTTPS socket and may require permission in sandboxed
   environments.
+- Go tests need a writable build cache; repo targets use
+  `GOCACHE=/tmp/enodia-go-cache` for sandbox-safe verification.
 - Run the full suite before committing:
 
 ```bash