M4: Anomaly Heuristics Engine

[lavochkaa]

flag suspicious patterns: high-RAM zero-thread
processes, ghost processes, orphan IOServices, suspicious entitlement combos, XPC
services without client checks, load command anomalies