feat(go): add Phase 1 parity sidecar

docs/ROADMAP.md

@@ -255,6 +255,15 @@ Exit criteria:
 - A local root attacker has to tamper with both the host and an external or
   hardware-backed trust anchor to hide compromise.
 
+## Active Migration Track
+
+- Suricata model assimilation design is complete, and Phase 0's additive
+  `enodia.event.v1` Python reference contract is implemented.
+- Phase 1 is in progress under `go-agent/`: a stdlib-only parallel sweep loop,
+  injectable process state, and the first poll-detector port (`deleted_exe`)
+  are checked against the Python oracle with a shared fixture. The Go sidecar
+  remains stdout-only and non-production until broader detector parity lands.
+
 ## Backlog
 
 Useful ideas that need design before implementation:
@@ -263,9 +272,6 @@ Useful ideas that need design before implementation:
 - YARA-compatible scanning for selected paths.
 - Sigma-like host event rules.
 - SBOM and package provenance reporting.
-- Suricata model assimilation: stateful sessions, EVE-style event envelope,
-  rule metadata/thresholding, datasets, and triggered forensic capture
-  ([SURICATA_ASSIMILATION.md](SURICATA_ASSIMILATION.md)).
 - Offline evidence bundle for outside analysis.
 - Dashboard import of exported incident bundles.
 - Support for non-pacman package managers in signed-package verification.