Add end-to-end sysadmin evidence and regression gates

[PrzemyslawKlys]

Summary

• add checked-in PowerForge performance gates for persistent watchers, 100,000-row storage, 5,000-record typed reporting, and the full detection timing/allocation matrix
• add a bounded sequential/parallel remote fan-out benchmark with exact per-source identity validation
• fix remote batch-query cancellation-token lifetime after parallel priming, proven against a real 5,000-record remote query
• add a pinned, tracked-file SigmaHQ compatibility audit and an explicit versioned Sysmon/PowerShell telemetry profile while keeping strict compilation as the default
• harden evidence contracts against ignored/untracked corpus files, hidden Git index states, sparse-checkout scope loss, cross-file correlation splits, multi-document framing drift, hung Git probes, aliased audit outputs, duplicate benchmark tuples, missing allocation diagnostics, unstable baseline updates, workload-identity drift, invalid or future heartbeat evidence, timeout-free remote boundary capture, and profile selector broadening
• add operator-owned WEC heartbeat-lag readiness checks and practical fleet guidance for planning, drift, enrollment, delivery completeness, and rollback
• document the existing versioned operational packs and make the README explicit that these capabilities are source-only and unreleased

Evidence

• local solution build: all target frameworks, zero warnings; exact .NET SDK 10.0.111 remains the CI gate
• EventViewerX tests: 1,428/1,428 on net8.0-windows and net10.0-windows
• portability tests: 44/44
• Windows PowerShell 5.1: 307 passed, 3 skipped
• live lab: lossless 10,000-event watcher burst; exact three-source remote fan-out; disposable source-initiated WEC delivery and rollback; 5,000-record remote query; realistic 100,000-row storage and 5,000-record HTML/Excel/email reporting
• all checked-in performance gates pass; baseline updates require stable measured samples, and reporting budgets are keyed by exact fixture SHA-256, typed count, and effective report sample count
• pinned SigmaHQ Windows corpus at 2e8fd89f82d9104c1b30321a307254ddeea17de2: strict 253/2,410; opt-in profile 2,213/2,410; unsupported rules remain explicit

Stack and release boundary

This PR depends on #123, which owns the portable EVTX parser/performance layer. Merge #123 first, then retarget or merge this layer.

This is source-readiness work only. It does not tag, publish, or release EventViewerX/PSEventViewer 4.0.

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-20T17:20:57.856259Z	f0bec9b	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9cf1e4022d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49bdaf5c4e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d1fbc31083

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".