feat(doctor): add causal timeline engine and cross-signal correlation #26

[Rakshak05]

Closes #26

What

Introduces a causal timeline sequencing engine for deterministic kerno doctor findings, structuring them by first-fired timestamp and linking them through pre-configured causation rules. It adds a box-drawn terminal view enabled via the --timeline flag and includes a structured timeline array in JSON output.

How

• Extended finding.go with a FiredAt timestamp and engine.go to track up to 10 minutes of signal history (maxHistory: 120).
• Implemented timeline.go to search history snapshots for the earliest metric threshold violations, link findings based on causal rule mappings, and apply confidence decay over elapsed gap times.
• Added a component-chain renderer inside render_timeline.go that organizes parallel/independent causal streams visually with custom arrows.
• Wired the timeline results into the LLM context within prompt.go and analyzer.go to instruct the AI summary to reference the timeline ID.

Testing

• go build ./... passes

• go test ./... passes

• go vet ./... passes

• golangci-lint run ./... passes

• Tested locally with: sudo ./bin/kerno doctor --duration 10s --timeline

• N/A — pure docs/refactor

• sudo ./bin/bpf-verify --read 5s confirms 6/6 programs still load

• ./scripts/verify.sh passes (or specific phase: ./scripts/verify.sh quality)

Checklist

• PR title follows Conventional Commits (feat(scope): subject)
• All commits are DCO-signed (git commit -s)
• No unrelated changes pulled in
• Documentation updated where user-visible behavior changed
• Added/updated tests for new code paths
• If a new doctor rule, paired with a chaos scenario in scripts/verify.sh

[github-actions]

🚀 First PR — welcome aboard!

A few things to expect:

1. CI: every PR runs build + race tests + lint + (eventually) the kernel matrix. If something fails, the log will tell you exactly which gate.
2. DCO: every commit needs Signed-off-by: — git commit -s adds it automatically.
3. Conventional Commits: PR titles like feat(doctor): add new rule or fix(bpf): handle X. We squash-merge by default.
4. Review: a maintainer will review within 72 hours. Suggestions are conversations, not orders — push back if something doesn't fit your context.

If you get stuck, reply here or jump to Discussions. We want this PR to land.