sigwood v0.2.5

Fixed

• A lone rare line read from the systemd journal now leads with its timestamp. Journal
  entries carry their time as a separate field rather than inside the message text, so these
  rows previously rendered as bare message text in an otherwise time-ordered section - the
  common case on a modern Linux install, where sigwood prefers the journal. The row now
  starts with the same syslog-shaped stamp the grouped rows use. Lines from syslog files are
  unchanged: they already begin with their own wall clock, and sigwood never adds a second
  stamp to a line that has one.

Changed

• Grouped syslog rows now show a few distilled lines from what they group, and stay on one
  line each in HTML reports. A review unit, burst, or reboot row is followed by up to three
  short fragments drawn from distinct message shapes inside it, so the row invites a closer
  look instead of only counting one. Fragments keep addresses, ports, process ids, exit codes
  and sizes, and drop only long opaque identifiers such as hashes and session tokens. On
  screen, syslog rows are clipped with a trailing ellipsis rather than wrapped or scrolled -
  widen the window to see more; printed reports still wrap so nothing is cut from a PDF. The
  leading stamp on those rows is now written in syslog's own wall-clock shape
  (Jul 12 21:57:33), so it reads in the same grammar as the log lines beside it. On a 7-day
  measurement corpus every grouped row carried fragments, with none empty.

• Rare syslog findings now separate a privileged program channel from the routine
  rarity sieve. Exact program membership in a shipped, operator-replaceable roster keeps
  security-critical families and singletons at MEDIUM; other rare families and singletons
  render as default-visible LOW, while bursts and reboots remain INFO. Family and burst rows
  now lead with their first timestamp, -v shows a three-line member sample, and HTML
  reports provide a closed full-sample expansion without leaking that body into printed
  reports. On the same 7-day measurement corpus, the report reads 12 privileged + 16
  routine + 10 info findings (38 total, under a minute to scan) - the increase over the
  prior 29 is privileged rows formerly buried inside info bursts, now independently
  reviewable.

• Syslog rare-event output now groups isolated lines into per-host, per-program review
  units and normalizes long identifier-like hexadecimal-character runs during template
  mining. Temporal bursts and reboot handling remain separate, while raw log text stays
  intact in evidence. On the measurement corpus, a 7-day multi-host run that previously
  reported 44 isolated rare-line findings now reports 19 review units (29 findings in
  total, from 56); a single quiet day reports about a dozen. Grouping changes how the
  findings are presented and counted, not what the detector observes - every rare line is
  still present in exactly one burst, family, or standalone finding.