pamsignal 0.2.0

pamsignal 0.2.0

Breaking change. Alert payloads move to Elastic Common Schema (ECS) for
both chat text and the JSON webhook. Anyone parsing v0.1.0's pipe-
delimited text or flat-JSON consumers will need to update.

Highlights:

• Chat text: severity-prefixed key=value (e.g. [ALERT] auth.brute_force_detected src=… attempts=… pid=… ts=…). Fixed-width severity bracket so columns
  align; new pid= field lets you kill <pid> straight from the alert.
• JSON webhook: full ECS schema — @timestamp, nested event.{action,
  category,kind,outcome,severity,module,dataset}, host.hostname,
  user.name, service.name, source.{ip,port}, process.{pid,user.id}.
  Custom fields under pamsignal.* per ECS guidance.
• systemd-journal: ECS-aligned structured fields (EVENT_ACTION, USER_NAME,
  SOURCE_IP, …) added alongside the existing PAMSIGNAL_* fields. Both
  available through v0.2.x; PAMSIGNAL_* retires in v0.3.0.
• ps_notify_brute_force gains a last_pid parameter; six new ECS helper
  functions in utils.h covered by 36 utils tests (was 30).
• docs/alerts.md rewritten with the new schema, a SIEM compatibility
  table, and a Vector example showing the conventional pamsignal →
  ingest layer → SIEM production architecture.

The webhook is drop-in for ECS-native SIEMs (Elastic, Wazuh) and one
Vector / Logstash config away from any other modern SIEM. ArcSight /
QRadar still need CEF or LEEF mapping at the ingest layer.

See CHANGELOG.md "0.2.0 — 2026-04-30" for the full notes.