Sentinel v1.1.0 — targeted scans + signature expansion

Targeted scans: on any server's Sentinel page, pick files/folders in its volume (checkbox browser with filter, or manual paths) and scan them. Findings are quarantined — the server is not suspended — and every file's outcome (quarantined / would_quarantine in dry-run / failed) is reported in the scan results. Node side is traversal-guarded; a guarded volume-listing endpoint backs the picker.

Signature expansion:

• Container escapes: docker.sock / docker run/exec, unshare, host mounts, ptrace attach (container-only, critical); cgroup release_agent/core_pattern tampering
• Abuse: nezha-agent, rathole, nps/npc, gost, brook, realm, tailscaled, zerotier-one; container-only tools (sshd, web terminals, filebrowser, rclone, aria2, torrents, cron) flagged only inside containers
• Miners: xmrig-proxy, dero-miner, verus-solver, monerod + pool domains; DDoS: mhddos, pyloris, booter/stresser, mirai/qbot/kaiten/tsunami
• Webshells (eval/shell_exec/child_process), miner configs, token/session stealers, xmrig log formats

All flows verified live: picker listing, traversal rejection, dry-run would_quarantine report, enforced quarantine with ledger row, freeroot jar detection on write + process detection.