[Shellghostt]

What this changes

Implements ENV007–ENV012 with explicit Docker/API, declared dependency, package-manager, Git, virtualenv and proxy evidence. Pure snapshot evaluators and offline explain/rules --json share an immutable registry with all twelve generated rule pages. Adds bounded strict project/registry contracts, compatible optional snapshot evidence, redaction and collector uncertainty handling.

Proxy networking is opt-in, bounded and sends no application bytes. Verification also fixes inherited subprocess output-limit bypass and preserves unknown Windows application-alias/interpreter evidence. All 54 original M2 fixtures retain their expected output; 118 reviewed cases bring the corpus to 172.

Closes #2

Why

ADR 0005 requires reliable observed prerequisites for each rule. Denied, failed or unknown evidence must not produce speculative findings. Shared registry metadata keeps CLI explanations, JSON and generated documentation consistent, and ordinary diagnosis remains offline.

How it was verified

M3 validation names acceptance tests, commands, live smoke checks and evidence limits.

Check	Result
make docs, make check-docs	Passed; all twelve generated page hashes stable
make test, native Windows make race	Passed, including 172 exact fixtures and built-CLI schema/exit checks
make lint, make build, govulncheck ./...	Passed; zero issues and no vulnerabilities found; static Windows binary
Linux race/static build and macOS amd64/arm64 cross-builds	Passed; native macOS execution supplied by CI
Live Windows, declared-project and loopback proxy smoke	Passed; normal diagnosis offline, opt-in proxy connection sent zero application bytes, project install hook never executed
Bounded proxy lifecycle	100 cycles, goroutines 3→2 and retained heap 377,944→340,936 bytes after GC
Branch CI at 22b468b	All five jobs passed, including native Windows/Ubuntu/macOS race, builds and documentation checks, lint and security
PR CI at 22b468b	All five jobs passed on the PR against main

Dependency presence is bounded metadata evidence, not proof an SDK can link. Proxy TCP success does not establish authentication or forwarding. Native memory observations cover the recorded finite workloads; broader clean-host/M6 budgets remain later work. Temporary listeners and smoke files were cleaned up, and existing machine PATH/Docker data preserved.

Checklist

• Tests added or updated for the new behaviour
• make lint passes
• Documentation updated (docs/, README.md roadmap, or api/)
• If a documented decision changed, an ADR was added in docs/adr/
• No claims of unverified behaviour: status fields still match reality
• No secrets, tokens or customer data in the diff