feat(go): advance validation sidecar toward production

README.md

@@ -64,14 +64,17 @@ Project docs:
 > detectors, and JSON output. The bash version and the Python version share one
 > red-team harness, so every signature is exercised against both.
 
-Phase 1 now also has an **experimental Go sidecar** under `go-agent/`. It emits
-the same `enodia.event.v1` envelope and captures an injectable `/proc` process
-and memory-map view plus `ss` sockets. The parity-checked cohort is `reverse_shell`,
-`ld_preload`, `deleted_exe`, `input_snooper`, `credential_access`,
-`stealth_network`, `memory_obfuscation` (including mapped hide/injection
-libraries), and `egress`. It is stdout-only and does not replace,
-install over, or write state for the Python daemon; Python remains authoritative
-until subsystem parity is complete.
+The migration also has an **opt-in Go validation sidecar** under `go-agent/`.
+It emits the same `enodia.event.v1` envelope, has fixture parity for all current
+poll detectors plus exec/syscall/typed-host rules and correlation, and uses
+embedded `cilium/ebpf` CO-RE probes for the live event paths. A separate
+hardened systemd unit writes JSONL to journald, retains a bounded copy of the
+event stream plus baseline state and an atomic heartbeat under
+`/var/lib/enodia-sentinel-go`, and fails open to polling if a probe cannot load.
+It also writes bounded `enodia.alert.snapshot.v1` JSON/text pairs with truthful
+status counts. It does not replace, install over, or write state for the Python
+daemon; Python remains authoritative for richer forensic enrichment, incidents,
+assurance, notifications, and the remaining subsystem parity.
 
 ## Why these detectors
 
@@ -171,14 +174,26 @@ enodia_sentinel/
     └── monitor.py      runs the probe on a thread, routes events → rules
 ```
 
-The parallel Phase 1 tree is intentionally isolated:
+The parallel migration tree is intentionally isolated:
 
 ```text
 go-agent/
-├── cmd/enodia-sentinel-go/  experimental JSONL sidecar
-└── internal/                config · model · system · detectors · schema · loop
+├── cmd/enodia-sentinel-go/  static JSONL validation agent
+└── internal/                config · capture · baselines · rules · eBPF · health
 ```
 
+Build or install the opt-in sidecar without changing the default service:
+
+```bash
+make build-go
+sudo make install-go
+sudo make enable-go
+enodia-sentinel-go --health
+```
+
+See [Go agent details](go-agent/README.md) and the
+[packaging guide](docs/PACKAGING.md) for its isolation and privilege contract.
+
 Three complementary detection paths feed one Alert → snapshot pipeline:
 
 - **Poll** — every few seconds, sweep `/proc`/`ss` (catches anything lingering).
@@ -309,6 +324,7 @@ drill only sets the env var on a throwaway process.
 make test          # stdlib unittest suite, no runtime deps
 make test-go       # stdlib-only Go sidecar unit tests
 make parity-go     # shared fixture: Go output vs Python oracle
+make check-go-service  # systemd validation + packaging isolation tests
 ```
 
 Detectors are pure functions over an injectable `SystemState`, so tests build