feat(go): advance validation sidecar toward production

docs/PACKAGING.md

@@ -62,6 +62,65 @@ sudo systemctl daemon-reload
 sudo systemctl restart enodia-sentinel.service
 ```
 
+## Go Migration Sidecar (opt-in)
+
+The Go agent has a separate validation service and is never installed by the
+default `make install` target or the Arch package. Build and install it
+explicitly from a checkout with Go 1.25 or newer:
+
+```bash
+make build-go
+sudo make install-go PREFIX=/usr/local
+sudo make enable-go
+```
+
+The static `enodia-sentinel-go` binary emits `enodia.event.v1` JSONL to the
+system journal. Its service owns `/var/lib/enodia-sentinel-go` for baseline
+state and a bounded retained event stream. `events.jsonl` rotates to one
+`events.jsonl.1` segment before crossing 64 MiB; both are private to root, and
+non-status records are synchronized before emission succeeds. The service
+requests the embedded native exec and syscall probes and fails open to polling
+when the kernel refuses a probe. It does not write the production Python
+daemon's `/var/log/enodia-sentinel` state or replace
+`enodia-sentinel.service`. Systemd readiness is emitted only after baseline
+initialization, event-log and snapshot-store preflight, and both requested probe
+load attempts complete.
+
+Alert events are additionally retained as private
+`alert-YYYYMMDD-HHMMSS.{json,log}` pairs in `/var/lib/enodia-sentinel-go`.
+Same-second events are merged into one snapshot, required
+`enodia.alert.snapshot.v1` fields are preserved, and the shared
+`max_snapshots` / `max_snapshot_age_days` settings bound retention. The current
+Go enrichment block is intentionally minimal; Python remains authoritative for
+incident grouping, rich enrichment, assurance chaining, and notifications.
+
+Each successful sweep atomically refreshes
+`/var/lib/enodia-sentinel-go/heartbeat` as a Unix timestamp with mode `0600`;
+the retained value becomes stale when the sidecar stops or wedges.
+`enodia-sentinel-go --health` reports that state as JSON and exits nonzero when
+it is unavailable or older than the configured `heartbeat_max_age`.
+
+Inspect the retained event stream without depending on journald:
+
+```bash
+sudo tail -n 50 /var/lib/enodia-sentinel-go/events.jsonl
+sudo enodia-sentinel-go --events-tail 50
+```
+
+The native reader includes `events.jsonl.1`, preserves chronological order, and
+fails nonzero if either retained segment contains malformed JSON.
+
+Inspect or remove the validation service with:
+
+```bash
+sudo make status-go
+sudo make disable-go
+sudo make uninstall-go
+```
+
+Uninstalling preserves the shared configuration and sidecar state for forensic
+review or a later reinstall.
+
 ## Debian and Ubuntu
 
 There is no native `.deb` package yet. Use the source install path: