core: add shared finisher + offset resolver + --full-chain flag

Adds the infrastructure the 7 🟡 PRIMITIVE modules can wire into for
full-chain root pops.

  core/offsets.{c,h}: four-source kernel-symbol resolution chain
    1. env vars (IAMROOT_MODPROBE_PATH, IAMROOT_INIT_TASK, …)
    2. /proc/kallsyms (only useful when kptr_restrict=0 or root)
    3. /boot/System.map-$(uname -r) (world-readable on some distros)
    4. embedded table keyed by uname-r glob (entries are
       relative-to-_text, applied on top of an EntryBleed kbase leak;
       seeded empty in v0.2.0 — schema-only — to honor the
       no-fabricated-offsets rule).

  core/finisher.{c,h}: shared root-pop helpers given a module's
    arb-write primitive.
      Pattern A (modprobe_path):
        write payload script /tmp/iamroot-mp-<pid>.sh, arb-write
        modprobe_path ← that path, execve unknown-format trigger,
        wait for /tmp/iamroot-pwn-<pid> sentinel + setuid bash copy,
        spawn root shell.
      Pattern B (cred uid): stub — needs arb-READ too; modules use
        Pattern A unless they have read+write.
    On offset-resolution failure: prints a verbose how-to-populate
    diagnostic and returns EXPLOIT_FAIL honestly.

  core/module.h: + bool full_chain in iamroot_ctx

  iamroot.c: + --full-chain flag (longopt 7, sets ctx.full_chain)
             + help text describing primitive-only-by-default + the
               opt-in to attempt the full chain.

  Makefile: add core/offsets.o + core/finisher.o to CORE_SRCS.

Build clean on Debian 6.12.86; --help renders the new flag.

iamroot.c

@@ -64,6 +64,12 @@ static void usage(const char *prog)
 "  --i-know              authorization gate for --exploit modes\n"
 "  --active              in --scan, do invasive sentinel probes (no /etc/passwd writes)\n"
 "  --no-shell            in --exploit modes, prepare but don't drop to shell\n"
+"  --full-chain          in --exploit modes, attempt full root-pop after primitive\n"
+"                        (the 🟡 modules return primitive-only by default; with\n"
+"                        --full-chain they continue to leak → arb-write →\n"
+"                        modprobe_path overwrite. Requires resolvable kernel\n"
+"                        offsets — env vars, /proc/kallsyms, or /boot/System.map.\n"
+"                        See docs/OFFSETS.md.)\n"
 "  --json                machine-readable output (for SIEM/CI)\n"
 "  --no-color            disable ANSI color codes\n"
 "  --format <f>          with --detect-rules: auditd (default), sigma, yara, falco\n"
@@ -606,6 +612,7 @@ int main(int argc, char **argv)
         {"no-shell",      no_argument,       0,  3 },
         {"json",          no_argument,       0,  4 },
         {"no-color",      no_argument,       0,  5 },
+        {"full-chain",    no_argument,       0,  7 },
         {"version",       no_argument,       0, 'V'},
         {"help",          no_argument,       0, 'h'},
         {0, 0, 0, 0}
@@ -627,6 +634,7 @@ int main(int argc, char **argv)
         case  3 : ctx.no_shell = true; break;
         case  4 : ctx.json = true; break;
         case  5 : ctx.no_color = true; break;
+        case  7 : ctx.full_chain = true; break;
         case  6 :
             if      (strcmp(optarg, "auditd") == 0) dr_fmt = FMT_AUDITD;
             else if (strcmp(optarg, "sigma")  == 0) dr_fmt = FMT_SIGMA;