feat: classify environment fingerprint reads

[kiranmagic7]

Closes #12

What changed

BehaviorLock now gives new reads of exact container, tracing, and environment fingerprint paths medium review rule BL600. Ordinary file reads keep their existing low BL500 rule, and sensitive reads still take precedence as critical BL100.

Matching is exact or descendant aware. Lookalike paths such as /.dockerenv.bak, /proc/self/status-old, and /sys/class/dmi-fake remain ordinary reads.

The parser also fixes numeric process path normalization. /proc/123/status now becomes the documented /proc/$PID/status, while /proc/123-backup/status remains unchanged.

Why

The current parser already observes these path reads, but comparison treated them as ordinary low level filesystem noise. Surfacing the path evidence helps a reviewer notice newly added environment fingerprinting without claiming the package is evasive or malicious.

The Desktop proposal assigned this meaning to BL500, but that identifier already has a public meaning. BL600 preserves report compatibility for ordinary reads.

Security and behavior impact

This changes comparison classification only. It does not change Docker flags, capabilities, network mode, capture input, profile behavior types, or schema versions. The new rule is medium, so the default high threshold still produces a review rather than a fail verdict.

ptrace, timing calls, directory enumeration, and other future anti analysis signals remain outside this change.

Compatibility

Existing ordinary reads remain BL500. Listed fingerprint paths now emit BL600 in newly generated diffs.

The /proc/<pid> correction changes targets and stable digests for affected development profiles produced by the old bug. Recapture both package versions with the same BehaviorLock commit before comparison.

Verification

1. Ran targeted compare, trace, and schema tests.
2. Ran make check, including formatting, vet, race enabled tests, shell syntax, ShellCheck, DCO tests, Actionlint, and JSON validation.
3. Ran make build.
4. Ran git diff --check.

AI assistance

AI tools assisted with the audit, implementation, tests, and documentation. The final rule contract was revised to preserve the existing BL500 meaning, and every submitted change was reviewed against the current code.

[kiranmagic7]

Supersession note: the current versioned BL600 environment-probe implementation is integrated in the green PR #24-#31 stack with the v3 evidence model and rule registry. Do not merge this older standalone branch into that stack without reconciliation.

[kiranmagic7]

Superseded by the consolidated PR #31. The BL600 rule and process path normalization work is retained there. Closing this standalone draft to keep one active upgrade review branch. No merge, release, or launch occurred.