feat(go): advance validation sidecar toward production

docs/ROADMAP.md

@@ -259,12 +259,39 @@ Exit criteria:
 
 - Suricata model assimilation design is complete, and Phase 0's additive
   `enodia.event.v1` Python reference contract is implemented.
-- Phase 1 is in progress under `go-agent/`: a stdlib-only parallel sweep loop,
-  injectable process/file-descriptor/socket state, and seven poll detectors
-  (`reverse_shell`, `ld_preload`, `deleted_exe`, `input_snooper`,
-  `credential_access`, `stealth_network`, `egress`) are checked against the
-  Python oracle with a shared fixture. The Go sidecar remains stdout-only and
-  non-production until broader parity lands.
+- Phase 1 under `go-agent/` now has a stdlib-only parallel sweep loop,
+  injectable process/file-descriptor/socket state, and all current Python poll
+  detectors ported: `reverse_shell`, `ld_preload`, `deleted_exe`,
+  `input_snooper`, `credential_access`, `stealth_network`, `egress`,
+  `memory_obfuscation`, `first_seen`, `new_listener`, `persistence`, and
+  `new_suid`. The shared fixture and `scripts/check-go-parity.py` check Go
+  output against the Python oracle. A new `provenance` package provides
+  pacman/dpkg/rpm ownership queries so the Go `new_listener` detector can
+  mirror Python's package-owned-listener suppression. Opt-in `--state-dir`
+  mode now builds listener/SUID baselines, applies the shared startup grace
+  gate, scans persistence paths, and retains first-seen network state. The Go
+  sidecar also has offline-replay parity for the exec rule family (built-ins
+  `100001`–`100004` plus configured `[[exec_rules]]`) and syscall rules
+  `100060`–`100066`, plus all typed host rules, the active rule catalog,
+  mixed-event JSONL routing, correlation SID `100080`, and sweep cooldown. The
+  first Phase 2 transports have landed as an opt-in `cilium/ebpf` execve
+  tracepoint source plus a filtered raw-syscall source for SIDs `100060`–
+  `100066`, both with CO-RE parent lookup, shared cooldown/emission, and
+  fail-open probe status. The syscall source also routes `setuid`/`setgid` into
+  typed-host SIDs `100071`/`100072` and permission/ownership changes into SID
+  `100070`, including relative-path resolution. Confirmed interpreter
+  `write`/`writev`/`pwrite` variants,
+  successful TCP connect/bind/listen/accept calls, `capset`, and `finit_module`
+  now feed typed-host SIDs `100069`, `100067`/`100073`/`100068`/`100076`,
+  `100077`, and `100078`. Phase 2 now also includes an opt-in hardened systemd
+  validation unit, static build/install path, isolated baseline state, and
+  journal JSONL. A bounded rotating JSONL copy provides isolated retained event
+  history, and an atomic heartbeat gives external watchdogs a non-journal
+  liveness signal. Bounded Python-schema-compatible JSON/text alert snapshots
+  now provide truthful retained counts and basic process context. The Python
+  service remains the production default until incident grouping, rich
+  enrichment/assurance, management-console consumers, and broader subsystem
+  parity land.
 
 ## Backlog