scaffold: 4 new module dirs + registry/Makefile wiring (stubs)

Pre-scaffolding for the next batch (CVE-2023-32233, CVE-2023-4622,
CVE-2022-25636, CVE-2023-0179). Each module ships as a 21-line
stub returning PRECOND_FAIL; parallel agents fill in the real
detect/exploit/--full-chain implementations.

This commit keeps registry.h / iamroot.c / Makefile in one place
so the 4 parallel agents don't collide on shared-file edits — they
each own a single iamroot_modules.c.

Build clean on Debian 6.12.86; --list shows all 24 modules
including the 4 new stubs.

iamroot.c

@@ -590,6 +590,10 @@ int main(int argc, char **argv)
     iamroot_register_af_packet2();
     iamroot_register_cgroup_release_agent();
     iamroot_register_overlayfs_setuid();
+    iamroot_register_nft_set_uaf();
+    iamroot_register_af_unix_gc();
+    iamroot_register_nft_fwd_dup();
+    iamroot_register_nft_payload();
 
     enum mode mode = MODE_SCAN;
     struct iamroot_ctx ctx = {0};