Phase 1: module interface + registry + top-level dispatcher

- core/module.h: struct iamroot_module + iamroot_result_t
- core/registry.{h,c}: flat-array module registry with find-by-name
- modules/copy_fail_family/iamroot_modules.{h,c}: bridge layer
  exposing 5 modules (copy_fail, copy_fail_gcm, dirty_frag_esp,
  dirty_frag_esp6, dirty_frag_rxrpc) wired to the absorbed DIRTYFAIL
  detect/exploit functions; df_result_t/iamroot_result_t share numeric
  values intentionally for zero-cost translation
- iamroot.c: top-level CLI dispatcher with --scan / --list / --exploit /
  --mitigate / --cleanup, JSON output, --i-know gate
- Restored modules/copy_fail_family/src/ structure (DIRTYFAIL Makefile
  expects it; the initial flat copy broke that contract)
- Top-level Makefile builds one binary; filters out DIRTYFAIL's
  original dirtyfail.c main so it doesn't conflict with iamroot.c

Verified end-to-end on kctf-mgr (Linux): clean compile, 5 modules
register, --scan --json output ingest-ready, exit codes propagate.

core/registry.h

@@ -0,0 +1,25 @@
+/*
+ * IAMROOT — module registry
+ *
+ * Global list of registered modules. Each family contributes via
+ * register_<family>_modules() called from iamroot main() at startup.
+ */
+
+#ifndef IAMROOT_REGISTRY_H
+#define IAMROOT_REGISTRY_H
+
+#include "module.h"
+
+void iamroot_register(const struct iamroot_module *m);
+
+size_t iamroot_module_count(void);
+const struct iamroot_module *iamroot_module_at(size_t i);
+
+/* Find a module by name. Returns NULL if not found. */
+const struct iamroot_module *iamroot_module_find(const char *name);
+
+/* Each module family declares one of these in its public header. The
+ * top-level iamroot main() calls them in order at startup. */
+void iamroot_register_copy_fail_family(void);
+
+#endif /* IAMROOT_REGISTRY_H */