Host self-scan v2: file-attribute (+a/+i) + journal-continuity checks (extends #955)

[MagnaCapax]

Scope (extends #955)

Two additional integrity checks for the host self-scan script introduced in #955. Both are small additions to that same script, held out of the v1 cut to keep the first pass simple and low-noise. Filed together because they are one change to one script with one shared definition-of-done.

• File-attribute check — flag unexpected +a (append-only) or +i (immutable) attributes on system paths. +a in particular is easy to miss when a check only looks for +i.
• Journal continuity check — flag gaps or truncation in the system journal, distinguishing a legitimate rotation from an anomaly (rotation-out-of-cadence, not merely "a gap").

Reporting discipline

Same as #955: a clean run is silent; only a finding surfaces.

Definition of done

• both checks added to the Built-in periodic host security self-scan (rootkit / LD_PRELOAD / miner IOC class) #955 self-scan script, tested against a clean fixture and a triggering fixture
• no separate cron or tool — extends the existing scan script
• blocked on Built-in periodic host security self-scan (rootkit / LD_PRELOAD / miner IOC class) #955 landing first

One-task note

Both are small additions to the SAME script (#955), one shared DoD, one PR — "extend the self-scan with the remaining two checks," not two independent tools.

---

_{Tier-3 declared at filing: --why no-known-fix — GH#631 tier gate. Declared fix size: unknown lines vs 20-line body — size gate (operator directive 2026-07-29). Owner: MagnaCapax/PMSS (declared; fix file not yet known — --why no-known-fix) — owner gate.}