Phase 1: module interface + registry + top-level dispatcher

- core/module.h: struct iamroot_module + iamroot_result_t
- core/registry.{h,c}: flat-array module registry with find-by-name
- modules/copy_fail_family/iamroot_modules.{h,c}: bridge layer
  exposing 5 modules (copy_fail, copy_fail_gcm, dirty_frag_esp,
  dirty_frag_esp6, dirty_frag_rxrpc) wired to the absorbed DIRTYFAIL
  detect/exploit functions; df_result_t/iamroot_result_t share numeric
  values intentionally for zero-cost translation
- iamroot.c: top-level CLI dispatcher with --scan / --list / --exploit /
  --mitigate / --cleanup, JSON output, --i-know gate
- Restored modules/copy_fail_family/src/ structure (DIRTYFAIL Makefile
  expects it; the initial flat copy broke that contract)
- Top-level Makefile builds one binary; filters out DIRTYFAIL's
  original dirtyfail.c main so it doesn't conflict with iamroot.c

Verified end-to-end on kctf-mgr (Linux): clean compile, 5 modules
register, --scan --json output ingest-ready, exit codes propagate.

Makefile

@@ -1,26 +1,68 @@
-# IAMROOT top-level Makefile
+# IAMROOT — top-level Makefile (Phase 1)
 #
-# Phase 0 (current): defers to modules/copy_fail_family/Makefile.
-# Phase 1: real dispatcher build that links all modules into one
-# binary. See ROADMAP.md.
+# Builds one binary `iamroot` linked from:
+#   - core/         module interface + registry
+#   - modules/<f>/  one family per subdir, contributes objects to the
+#                   final binary
+#   - iamroot.c     top-level dispatcher
+#
+# Each family is currently flat (Phase 1 keeps copy_fail_family's
+# absorbed DIRTYFAIL source in modules/copy_fail_family/src/).
+# Future families register the same way: add their register_* call to
+# iamroot.c's main() and add their src dir to MODULE_DIRS below.
 
-MODULES := copy_fail_family
+CC      ?= gcc
+CFLAGS  ?= -O2 -Wall -Wextra -Wno-unused-parameter -Wno-pointer-arith \
+           -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64
+LDFLAGS ?=
 
-.PHONY: all clean $(MODULES)
+BUILD   := build
+BIN     := iamroot
 
-all: $(MODULES)
+# core/
+CORE_SRC := core/registry.c
+CORE_OBJ := $(BUILD)/core/registry.o
 
-$(MODULES):
-	$(MAKE) -C modules/$@
+# Family: copy_fail_family
+# All DIRTYFAIL .c files contribute; iamroot_modules.c is the bridge.
+CFF_DIR  := modules/copy_fail_family
+CFF_SRCS := $(wildcard $(CFF_DIR)/src/*.c) $(CFF_DIR)/iamroot_modules.c
+# Filter out the original dirtyfail.c (its main() conflicts with iamroot.c's main).
+CFF_SRCS := $(filter-out $(CFF_DIR)/src/dirtyfail.c, $(CFF_SRCS))
+CFF_OBJS := $(patsubst %.c,$(BUILD)/%.o,$(CFF_SRCS))
+
+# Top-level dispatcher
+TOP_OBJ  := $(BUILD)/iamroot.o
+
+ALL_OBJS := $(TOP_OBJ) $(CORE_OBJ) $(CFF_OBJS)
+
+.PHONY: all clean debug static help
+
+all: $(BIN)
+
+$(BIN): $(ALL_OBJS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^
+
+# Generic compile: any .c → corresponding .o under build/
+$(BUILD)/%.o: %.c
+	@mkdir -p $(dir $@)
+	$(CC) $(CFLAGS) -Icore -I$(CFF_DIR)/src -c -o $@ $<
+
+debug: CFLAGS := -O0 -g3 -Wall -Wextra -Wno-unused-parameter -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64
+debug: clean $(BIN)
+
+static: LDFLAGS += -static
+static: clean $(BIN)
 
 clean:
-	@for m in $(MODULES); do \
-		$(MAKE) -C modules/$$m clean; \
-	done
-	rm -rf build/
+	rm -rf $(BUILD) $(BIN)
 
-# Convenience: scan the host using the absorbed DIRTYFAIL-as-module
-# until Phase 1's real dispatcher lands.
-scan:
-	@modules/copy_fail_family/dirtyfail --scan 2>/dev/null || \
-	 (echo "Build the copy_fail module first: make copy_fail_family" && exit 1)
+help:
+	@echo "Targets:"
+	@echo "  make           build optimized iamroot binary"
+	@echo "  make debug     build with -O0 -g3"
+	@echo "  make static    build a fully static binary"
+	@echo "  make clean     remove build artifacts"
+	@echo ""
+	@echo "Per-module (legacy) — not built by default:"
+	@echo "  cd modules/copy_fail_family && make"