feat(go): advance validation sidecar toward production

docs/SURICATA_ASSIMILATION.md

@@ -233,8 +233,26 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
   `input_snooper`, `credential_access`, `stealth_network`, the
   `memory_obfuscation` cohort, and `egress`;
   Python remains the production agent.
-- **Phase 2 — eBPF via `cilium/ebpf`.** Port exec/syscall rules; drop the
-  bcc/Python runtime dependency; single static binary.
+- **Phase 2 — eBPF via `cilium/ebpf`.** The transport-independent exec/syscall
+  event models and rule engines have offline Python-envelope parity in Go. An
+  opt-in native execve and filtered raw-syscall tracepoints now feed both rule
+  engines through `cilium/ebpf` with CO-RE parent lookup and fail-open polling
+  fallback; root UID/GID transitions and persistence-path permission changes
+  plus capability-set and file-backed module-load requests also feed the
+  typed-host engine. Interpreter `write`/`writev`/`pwrite` variants are
+  enter/exit-correlated and filtered in-kernel before their FD paths are
+  resolved in userspace. Successful
+  connect/bind calls are likewise correlated, with TCP inode verification for
+  connect events; listen/accept calls resolve both endpoints from the successful
+  socket FD.
+  An opt-in hardened systemd validation unit now runs the static Go binary with
+  isolated baseline state, journal JSONL, a bounded retained JSONL stream, and
+  an atomic health marker. All current typed-host families now have native
+  transports. Bounded `enodia.alert.snapshot.v1` JSON/text pairs now retain
+  alerts with basic process context and feed truthful status counts. Incident
+  grouping, rich enrichment/assurance, management-consumer integration, and
+  broader parity must land before the bcc/Python runtime dependency can be
+  dropped.
 - **Phase 3 — Rule-engine parity + assimilation.** `rev`/`reference`/`metadata`,
   statebits (flowbits), thresholding, suppression, and — if rule count warrants
   — the MPM prefilter. `rules list/show/test/docs` parity.