feat(go): add bounded hot-path enrichment

docs/GO_PORT_HANDOFF.md

@@ -1,8 +1,8 @@
 # Go Port Handoff
 
-Saved: 2026-07-22T01:58:38-07:00
+Saved: 2026-07-22T02:03:00-07:00
 Branch: `main`
-Base commit: `f85c2e8` (`feat(go): advance validation sidecar toward production`)
+Base commit: `6d5a897` (`feat(go): persist Python-compatible incidents`)
 Status: implemented and green, but uncommitted
 
 ## Worktree warning
@@ -10,8 +10,8 @@ Status: implemented and green, but uncommitted
 The checkout is intentionally dirty and contains work from multiple related
 continuations. Do not reset, clean, or broadly restage it.
 
-- The completed validation-sidecar tranche was committed as `f85c2e8` before
-  this continuation. The current Go incident tranche is not yet committed.
+- The validation-sidecar and incident-persistence tranches are committed as
+  `f85c2e8` and `6d5a897`. The bounded-enrichment slice is uncommitted.
 - At this checkpoint, `git status --short` has 20 entries with untracked
   directories collapsed.
 - The Python GUI files and tests are separate pre-existing work. Preserve them
@@ -90,9 +90,12 @@ static binary.
   additively and correlation SID `100080` is persisted. Python's unchanged
   `list_incidents` and `get_incident` consumers successfully loaded a live
   Go-produced index, snapshot, and timeline.
-- Enrichment currently contains only a Go-source marker plus process detail;
-  rich enrichment, assurance chaining, and notification fan-out are not yet
-  ported.
+- A bounded no-I/O enrichment stage now derives Python-shaped process/parent
+  context, lineage, remote-IP classification, and candidate paths entirely from
+  already-captured records. Alert/process/indicator caps bound attacker-
+  controlled work on the emission path.
+- Package ownership, executable hashes, file metadata, integrity anchors,
+  assurance chaining, and notification fan-out are not yet ported.
 - No live system service was installed or enabled during development.
 
 ## Last green verification
@@ -137,9 +140,9 @@ the suite still exits successfully.
 
 ## Resume here
 
-1. Port bounded post-alert enrichment and local assurance chaining without
-   adding destructive response behavior or blocking the event loop on slow
-   collectors.
+1. Move slow enrichment collectors (ownership, bounded hashing, file metadata,
+   integrity anchors) behind a bounded asynchronous worker, then add local
+   assurance chaining without destructive response behavior.
 2. Connect the isolated Go snapshot/event state to explicit read-only
    management consumers while keeping Python authoritative.
 3. Continue broader Phase 3 rule metadata/state parity before considering any