Add Phase 1 advanced stealth modules: anti-forensics, traffic mimicry, JA3 spoofing, IDS testing, LKM rootkit, overlayfs manager

6 Python modules extending BaseModule + LKM kernel module template:
- anti_forensics.py: timestomping, core dump disable, swap off, journal vacuum, history suppression, bettercap tmpfs home, secure deletion
- traffic_mimicry.py: two-phase baseline/shaping engine matching implant traffic to observed network patterns
- ja3_spoofer.py: TLS fingerprint spoofing with Chrome/Firefox/Edge profiles, iptables NFQUEUE interception, SSL context configuration
- ids_tester.py: on-demand Snort/Suricata rule assessment with risk levels, preflight validation, caplet analysis
- lkm_rootkit.py: kernel module lifecycle (build/load/unload) for process/file/connection hiding on generic Debian hosts
- overlayfs_manager.py: tmpfs-backed overlayfs with tier-aware size budgets for zero SD card write activity
- bb_hide.c: ftrace-based LKM hooking getdents64/tcp4_seq_show/udp4_seq_show with self-hiding from lsmod
- Makefile: standard out-of-tree kernel module build

modules/stealth/__init__.py

@@ -6,6 +6,12 @@ from modules.stealth.log_suppression import LogSuppression
 from modules.stealth.encrypted_storage import EncryptedStorage
 from modules.stealth.tmpfs_manager import TmpfsManager
 from modules.stealth.watchdog import Watchdog
+from modules.stealth.anti_forensics import AntiForensics
+from modules.stealth.traffic_mimicry import TrafficMimicry
+from modules.stealth.ja3_spoofer import JA3Spoofer
+from modules.stealth.ids_tester import IDSTester
+from modules.stealth.lkm_rootkit import LKMRootkit
+from modules.stealth.overlayfs_manager import OverlayfsManager
 
 __all__ = [
     "MacManager",
@@ -14,4 +20,10 @@ __all__ = [
     "EncryptedStorage",
     "TmpfsManager",
     "Watchdog",
+    "AntiForensics",
+    "TrafficMimicry",
+    "JA3Spoofer",
+    "IDSTester",
+    "LKMRootkit",
+    "OverlayfsManager",
 ]