feat: add explicit identity and lifecycle contract

[DavidJBianco]

Summary

Implements the explicit identity and lifecycle contract across three reviewable milestone commits:

1. Adds canonical process, thread, and session identities with durable host/start-scoped state.
2. Centralizes process/session lifecycle ownership, grouping, actor attribution, and source timing.
3. Extends eCAR 1.1 roles, reduces eCAR flush to serialization, preserves canonical SSH/Sysmon identity, and makes endpoint FLOW identity host-local.

No feature-branch version bump.

Root-cause fixes

• Process objects are host- and start-scoped; thread keys are (hostname, process_object_id, tid).
• Linux leaders use tid == pid; Windows primary threads use deterministic host-native TIDs.
• Process/session action bundles own allocation and lifecycle transitions.
• eCAR consumes frozen identity plans and no longer invents, repairs, scrubs, or deduplicates identity during flush.
• ProcessAccess and remote-thread rows expose explicit source and target roles with canonical TIDs.
• Session closure waits for all session-owned process evidence; network activity protects actor lifetimes through close.
• Sysmon trusts canonical terminal-session state and rejects missing ProcessAccess source TIDs.
• Host-local eCAR FLOW rows expose only the local process actor.
• Syslog finalization no longer rewrites SSH child PIDs.

Validation

• uv run pytest --no-cov -q: 4,948 passed, 19 skipped.
• Focused identity/eCAR/Sysmon/syslog/SSH/RDP/source-timing set: 302 passed.
• Ruff check and format check: clean.
• Config validation: 87 files, zero findings.
• iteration-test-expanded: valid with 26 pre-existing topology/storyline warnings.
• Evaluation: 95.3421 overall across 86,294 records.
  • Parseability 100.00
  • Plausibility 97.27
  • Causality 88.02
  • Timing 95.10

Rendered hard probes found zero duplicate IDs, PID/TID ownership mismatches, post-termination references, session-object mismatches, terminal-session mismatches, cross-host FLOW actors, remote identity leakage, or SSH PID collisions.

Blind panel

The corrected data-only four-reviewer panel completed the required anonymized reconciliation round. All four verdicts were Inconclusive and all four explicitly passed the identity/lifecycle contract:

Role	Synthetic confidence	Realism	Identity/lifecycle
Threat hunter	48	89	96
Detection engineer	47	88	95
Network forensics	47	88	95
Host/EDR forensics	47	89	95

Residual findings concern timing/distribution, record-counter, scan, and collection-manifest texture and remain outside this phase.