feat(lab9): Falco runtime detection + Conftest policy gate

[Philip-78]

Goal

Run Falco with modern eBPF on Colima, trigger baseline + custom alerts, write Conftest/Rego policies gating K8s and Compose manifests.

Changes

• labs/lab9/falco/rules/custom-rules.yaml — Write-to-/tmp rule + cryptominer process detection rule
• labs/lab9/policies/extra/pod-hardening.rego — 4 extra Rego rules (namespace, automount, seccomp, runAsUser)
• submissions/lab9.md — all Falco alerts, Conftest outputs, tuning discussion

Testing

• Falco baseline: "Terminal shell in container" (Notice) + "Read sensitive file untrusted" (Warning)
• Custom rule: "Write to /tmp by container" fired on echo > /tmp/my-write.txt
• Cryptominer rule: fired on xmrig binary execution (Critical)
• Conftest unhardened: 9 failures across k8s.security + extra.pod namespaces
• Conftest compose: PASS on juice-compose.yml, FAIL on bad-compose.yml

Artifacts

• submissions/lab9.md — full analysis

---

• Task 1 — 2 baseline + 1 custom Falco alert with tuning discussion
• Task 2 — 3+ Conftest rules (K8s pass/fail) + compose policy run
• Bonus — Cryptominer detection rule with triggered alert