feat(process): publish v0.3 system-evidence bridge

[stacknil]

Summary

• add a local linux-process-observe adapt subcommand for process_diff.json
• emit telemetry-lab-compatible JSONL with stable required fields and deterministic evidence metadata
• keep the release at four mini-labs; do not duplicate telemetry-lab demos
• publish v0.3.0 release materials for the 408-to-security bridge

Design decision

The adapter stays inside linux-process-observe because its source contract is stacknil.system-evidence.v1. It maps process changes to process_* events and socket-link changes to socket_link_* events while preserving the original identity and field changes in metadata. No code changes are made in telemetry-lab; its existing event loader/window workflow is the consumer boundary.

Main risk

A process diff is saved snapshot evidence, not live telemetry. The adapter intentionally does not infer causality, reachability, compromise, or authoritative process identity from executable paths or PID context.

Compatibility impact

Existing process snapshot, socket-link, diff, and report schemas are unchanged. The new JSONL has telemetry-lab's required timestamp, event_type, source, target, and status fields. Unlinked sockets use a deterministic PID fallback source when available.

Rollback path

Revert the three commits or remove the adapt subcommand and adapter module. Existing snapshot/diff workflows remain independently usable.

Validation

• systems-foundations mini-labs: 44 passed
• telemetry-lab: 190 passed
• adapter consumer run: 7 events loaded, 1 window generated, features/alerts/summary/manifest and plots written
• git diff --check passes

Release gate

This PR is intentionally draft because the release diff touches 11 files. After checks and bot review, perform a final diff review, keep the PR open for the required review window, then merge and tag v0.3.0.

[stacknil]

Semantic contract follow-up in 5fc4673:

• Design decision: add metadata.time_semantics = snapshot_diff_observed_at to every adapter record. Keep the required top-level timestamp mapped to the envelope observed_at, because it is the snapshot-comparison observation time.
• Main risk: downstream window consumers may still read timestamp as an occurrence time. The new metadata and release documentation make that interpretation invalid: a window groups evidence deltas observed in one comparison, not proven system activities that happened together.
• Compatibility impact: additive metadata only; existing telemetry-lab fields (timestamp, event_type, source, target, status) and event values remain unchanged. The golden JSONL now locks the metadata on all seven records.
• Rollback path: revert 5fc4673; this removes only the semantic label and documentation, with no persisted-data migration required.

Validation: linux-process-observe 16 passed; auth/socket/permission suites 14/8/6 passed; adapter compatibility test 4 passed. This repository has no CI workflow configured beyond Dependabot, so GitHub reports no checks. Per the report/schema risk policy, keep PR #3 draft until a delayed review confirms the semantic boundary.