Fix CaptureBus cross-fork visibility — restart reader in each module subprocess

With multiprocessing fork, threads are not inherited. The parent's
CaptureBus reader thread runs in the parent but module subprocesses
subscribe AFTER fork, so their SubscriberQueue entries are added to
a child-local copy of _subscribers that the parent reader never sees.

Fix: reset and restart CaptureBus in each module subprocess so it
has its own reader thread on the inherited AF_PACKET socket. Each
module gets independent packet delivery. Linux AF_PACKET allows
multiple readers on the same interface.

core/engine.py

@@ -176,6 +176,18 @@ def _module_runner(module_class: Type[BaseModule], bus_queue: multiprocessing.Qu
     state = StateManager(db_path=state_db_path)
     state.start()
 
+    # CaptureBus reader thread is not inherited across fork — restart it in
+    # this subprocess so the module's subscribe() calls reach a live reader.
+    for key in ("capture_bus", "_capture_bus"):
+        cb = config.get(key)
+        if cb is not None:
+            cb._running = False
+            cb._capture_thread = None
+            cb._sock = None
+            cb._subscribers = []
+            cb.start()
+            break
+
     module = module_class(bus=bus_proxy, state=state, config=config)
 
     # Signal handlers for graceful shutdown