feat(go): port process access detectors

docs/ROADMAP.md

@@ -260,9 +260,10 @@ Exit criteria:
 - Suricata model assimilation design is complete, and Phase 0's additive
   `enodia.event.v1` Python reference contract is implemented.
 - Phase 1 is in progress under `go-agent/`: a stdlib-only parallel sweep loop,
-  injectable process state, and the first poll-detector port (`deleted_exe`)
-  are checked against the Python oracle with a shared fixture. The Go sidecar
-  remains stdout-only and non-production until broader detector parity lands.
+  injectable process/file-descriptor state, and the first poll-detector cohort
+  (`ld_preload`, `deleted_exe`, `input_snooper`, `credential_access`) are
+  checked against the Python oracle with a shared fixture. The Go sidecar
+  remains stdout-only and non-production until broader parity lands.
 
 ## Backlog
 

docs/SURICATA_ASSIMILATION.md

@@ -228,7 +228,8 @@ signature keeps `sid` / `signature` / `classtype` / tests / docs.
   equivalent, poll detectors ported, JSON output matching schemas. Runs
   alongside Python; harness compares both. *In progress:* the isolated
   `go-agent/` sidecar now has stdlib config loading, an injectable `/proc`
-  process view, the JSONL sweep loop, and fixture parity for `deleted_exe`;
+  process/file-descriptor view, the JSONL sweep loop, and fixture parity for
+  `ld_preload`, `deleted_exe`, `input_snooper`, and `credential_access`;
   Python remains the production agent.
 - **Phase 2 — eBPF via `cilium/ebpf`.** Port exec/syscall rules; drop the
   bcc/Python runtime dependency; single static binary.