feat(signal): expose privilege auth audit signals

[stacknil]

Summary

• expose parsed sudo auth failure, sudo policy denied, and su auth failure events as audit-only auth signals
• keep all detector-counting flags false for these privilege auth signals
• add a detector/signal regression test proving visibility without new findings

Tests

• cmake --build build --config Debug --target test_detector
• ctest --test-dir build -C Debug --output-on-failure -R "^detector$"
• cmake --build build --config Debug
• ctest --test-dir build -C Debug --output-on-failure
• git diff --check
• privacy/security string scan on touched files

[stacknil]

Post-CI maintainer note:

• Design decision: expose parsed sudo auth failure, sudo policy denied, and su auth failure as audit-only AuthSignal kinds instead of feeding them into existing detector counters.
• Main risk: downstream code that assumed these parsed events produced no signal may now see additional non-counting signals; detector findings remain unchanged by test coverage.
• Compatibility impact: no CLI/report schema change and no rule-threshold behavior change.
• Rollback path: revert commit a4b6aaa to remove the three signal mappings and their regression test.