Split detection from transport behind a Backend trait

[grloper]

Wraith's detection model — provenance, W^X, stack-integrity, and the
exploitation-chain correlator — was interleaved with the ptrace reap loop
in tracer.rs, so the eBPF backend the README already names as the
near-zero-overhead production path had nowhere to attach.

Extract the transport-agnostic detection core into src/engine.rs:

• Engine owns the per-address-space cached memory map, the per-process
  live stats, the Detector, the run Summary, and the enforce-on-CRITICAL
  policy. It captures a neutral SyscallEntry register snapshot and, in
  inspect(), refreshes the map, runs detection, and returns the
  enforcement Action to carry out — without ever issuing a ptrace call.
• Backend is the trait a transport implements (drive()). Tracer becomes
  the first Backend: it keeps only what is ptrace-specific — the waitpid
  loop, register reads, thread entry/exit phase, and the enforcement
  mechanism (rewriting the syscall number, SIGKILLing the tree).
• Summary, ProcStat, and Reporter move to engine.rs and are re-exported
  from tracer.rs, so wraith::tracer::{...} paths stay source-compatible.

Behavior is unchanged: the map dirty/refresh timing, syscall counting on
a lost getregs, the CRITICAL-only enforcement gate, and the fatal-fault
signal path are all preserved. Full suite (37 unit + 5 bin + 10
integration) passes and clippy is clean; a live run still reports benign
as clean and shellcode-sim as an EXPLOITATION CHAIN.

An eBPF backend can now implement Backend and reuse the entire Engine,
swapping only how a syscall stop is obtained.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01FiEuoW9Kpfw6Gv1d3pCXgs