v0.4.0 - Risk heuristics

hightower stops just listing processes and starts judging them. scan --all
now assigns each process a risk verdict and sorts the flagged ones to the top.

What's new

• Risk verdicts on every process: trusted / review / suspicious, in a
  new RISK / PID / NAME / CATEGORY / PATH table, worst-first, with a summary
  line (N suspicious, M to review).
• Three heuristics (Strategy pattern, in core):
  • Path masquerading -- a known Windows name running from the wrong folder ->
    suspicious.
  • Unsigned / untrusted binary -- via Authenticode WinVerifyTrust.
  • Unknown process -- not in the database and not validly signed -> review.
• Authenticode signature checks (adapters), run in parallel across
  processes with std::thread::scope.

Limitations (by design)

• Educational aid, not an antivirus -- verdicts are prompts to investigate,
  not proof. Expect false positives and false negatives.
• Signature checks read embedded signatures only; catalog-signed system
  binaries are handled via the known-process database instead.
• Publisher-name extraction and richer filtering are still to come.

Download

hightower-v0.4.0-x86_64-pc-windows-msvc.exe (Windows x64, unsigned -- SmartScreen
may warn). Or build from source: cargo build -p hightower-cli --release.

Next

v0.5.0 -- hightower explain <name|pid> and scan --json.