fix: improve cross-source lifecycle and identity realism

[DavidJBianco]

Summary

• add a canonical Linux sudo-session action bundle with grouped observation and ordered authorization/PAM lifecycle evidence
• keep SSH/RDP and general endpoint FLOW observations inside canonical transport intervals and before successful remote authentication
• correct Windows Security record-ID reset behavior, Kerberos SPN/account identity, and Event 4688 creator-versus-target security context
• preserve initiating-process identity for DNS while retaining resolver transport ownership
• align TLS resumption history, DNS sensor timing, and eCAR process/thread attribution with their owning canonical contracts
• add focused regression coverage, the expanded-assessment worklog, and the updated assessment-effectiveness dashboard

Why

Blind realism loops 62–72 repeatedly exposed sibling defects caused by truth being reconstructed too late or independently in source renderers. These changes move lifecycle, timing, and identity ownership into action bundles, canonical contexts/state, source observation, and source timing so correlated sources agree by construction.

Impact

The generated evidence now preserves remote transport-before-auth ordering, canonical connection intervals, complete sudo lifecycle observation, source-native Windows identity semantics, DNS query-process attribution, and coherent eCAR PID/TID handling. The assessment artifacts document the remaining higher-level work around durable state, packet accounting, stable sensor timing, and final-window admission.

Validation

• final default suite: 4,911 passed, 19 skipped
• repository-wide uv run ruff check .
• repository-wide uv run ruff format --check .
• configuration and expanded scenario validation
• per-loop focused regression tests and rendered hard probes
• final automated evaluation: 95.839, PASS over 93,351 generated records

This PR intentionally targets dev. Version and changelog release updates remain part of the later dev → main release PR.