feat(validator): M81-4 per-module health derivation (Day 1+2)

[itcmsgr]

Summary

Implements M81-4 (HEALTH_METRIC_DERIVATION_v1.81.md) in the Go validator.
Per-module 4-axis health evaluation: config, structural, runtime, effective.

Day 1 — Module health evaluator

• module_health.go: evaluateModuleHealth() + per-module evaluators
  (BotGuard, DDoS, Portscan, LoginMon, Blacklist)
• Config readers with .local override chain
• BotGuard dual-family structural check (Rule 9)
• StatusIdle enum + overall status emits idle when all modules idle
• SchemaVersionCurrent = "1.81.0"
• ModuleHealthMap, ConfigState, StructuralState, EffectiveState types
• BlacklistHealth with manual/feeds/geoban sub-states
• Geoban DB missing = degraded (per M81-3 contract)

Day 2 — Evidence fidelity

• DDoS reads real kernel named counters → effective axis
  (5 enforcement counters, any > 0 = ENFORCING)
• Portscan effective = IDLE with documented gap (no dedicated counter, per M81-3)
• Live verified on lab4: DDoS reports "enforcing" from kernel evidence

Live output (lab4)

{
  "schema_version": "1.81.0",
  "status": "protected",
  "modules": {
    "botguard":  { "config": "disabled" },
    "ddos":      { "config": "enabled", "structural": "present", "effective": "enforcing" },
    "portscan":  { "config": "enabled", "structural": "present", "effective": "idle" },
    "loginmon":  { "config": "enabled", "structural": "present", "runtime": "RUNNING", "effective": "idle" },
    "blacklist": { "manual": {"state":"idle"}, "feeds": {"state":"disabled"}, "geoban": {"state":"degraded"} }
  }
}

Tests

35/35 PASS on lab4. 20 new M81-4 tests + 15 existing B80 tests.

Scope

internal/validator/ only. No shell. No CLI. No runtime.

🤖 Generated with Claude Code

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 2d33872.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None