build: establish secure AegisAI MVP foundation and prerequisite gate

[parthozyy]

Summary

Establishes the security-first foundation for the one-week AegisAI research prototype.

• Adds the secure MVP architecture specification.
• Adds the complete task-by-task implementation plan.
• Pins and validates developer and Ubuntu UTM prerequisites.
• Migrates the firewall sensor baseline to Suricata 8.0.6.
• Adds secure, check-only-by-default macOS and Ubuntu bootstrap scripts.
• Documents UTM setup, snapshots, recovery, and management-network safeguards.

Security controls

• Python >= 3.12
• Go >= 1.25.5 with exact host OS/architecture validation
• OPA exactly 1.19.0
• Suricata exactly 8.0.6; Suricata 7 rejected as EOL
• Official SHA-256 inventory for pinned Go and OPA assets
• Canonical, fail-closed version parsing
• Bounded subprocess output and execution deadlines
• Cleanup of descendant probe processes
• Ubuntu 24.04 Noble enforcement
• Origin-bound OISF PPA validation with pinned signing fingerprint
• Exact Suricata package selection
• Interactive opt-in installation only
• Pre-install and post-bootstrap VM recovery snapshots

Validation

• 45/45 automated tests passing
• Both bootstrap scripts pass bash -n
• Clean Git diff and worktree
• Independent specification review passed
• Independent code-quality and security review passed
• No Critical or Important findings remain

Current readiness

Ready to begin Task 1: Python/Go project scaffolding and secure generated-file rules.

Remaining environment checkpoints

• Refresh Homebrew metadata before installing OPA 1.19.0 if the local cache is stale.
• Install the currently missing local OPA and ShellCheck prerequisites.
• Run the Ubuntu bootstrap and installation checks inside the UTM VM.
• Perform real nftables, Suricata, systemd, and namespace testing only inside the authorized VM.

Scope

This PR establishes planning and prerequisite infrastructure only. It does not yet enable firewall enforcement or modify the other contributor’s implementation branch.