v0.3.5

Much less false-positive noise

A bare, safe cable and an ordinary USB keyboard were both producing dozens of
spurious phase-differences and findings. Fixed the noise sources without
weakening real detection (a BadUSB keyboard still flags HIGH):

• listeners — drops LISTEN sockets on ephemeral-range ports (≥ the
  kernel's ip_local_port_range low bound, default 32768). RPC, mDNS and IDE
  remote-helper sockets churn these constantly, and no implant binds a backdoor
  to a port that changes on every restart. Rule new-listener-on-connect
  lowered medium → low.
• process — skips kernel threads (kworker/*, ksoftirqd/*, … — children
  of kthreadd), which the kernel spawns, renames and reaps nonstop.
• input — the udev input subsystem lists every device twice (the logical
  inputN node and its eventN / mouseN child); CableProbe now keeps only
  the logical one, removing duplicate findings.
• rules — new not_contains attribute condition; the generic HID rule no
  longer double-reports a keyboard or pointer that already matched its own
  higher-severity rule.

On the reporter's keyboard run this cut 59 phase-differences → ~18 and 26
findings → ~9, all still about the keyboard.

pipx upgrade cableprobe