Fix repeated incomplete-handshake false positives

[awlx]

Summary

• expire pending TCP handshakes after a 3-second monotonic timeout and consume each stale map entry exactly once
• use two-phase eBPF map iteration/deletion for both IPv4 and IPv6, avoiding unsafe deletion during hash-map iteration
• emit evidence only when cleanup successfully consumes the entry, so a concurrently completed handshake is not reported
• preserve per-poll rate semantics and include the timeout and observation window in signal metadata
• prevent aggregate snapshots from training per-connection timing, ASN baselines, clock skew, or entropy while retaining them as detection/reputation evidence

Root cause

A SYN whose final ACK was not observed remained in pending_handshakes indefinitely. The collector emitted that same entry on every one-second map poll, and the analyzer interpreted the polling cadence as client connection timing. Repeated snapshots therefore produced incomplete_handshake + timing_pattern detections for ordinary traffic and mechanically raised confidence.

Safety

The change is symmetric for IPv4 and IPv6. It does not make enforcement stricter, alter dry-run behavior, or change eBPF programs. Deploy in dry-run first and confirm the repeated signature collapses before considering enforcement.

Validation

• go test -race ./pkg/collector ./pkg/analyzer ./pkg/patterns
• make portable-test
• make analyzer
• make yeetctl
• git diff --check

Linux CI is still required for collector/eBPF build, verifier/runtime, and HAProxy end-to-end coverage because the local host is macOS.