feat(lab9): falco custom rules + conftest hardening policies

[raylduk8]

Goal

Runtime detection with Falco (eBPF) + Policy-as-Code with Conftest for Kubernetes manifest hardening.

Changes

• labs/lab9/falco/rules/custom-rules.yaml: 2 custom Falco rules (write to /tmp + reconnaissance detection)
• labs/lab9/policies/extra/hardening.rego: 6 Conftest policies for K8s hardening (runAsNonRoot, allowPrivilegeEscalation, capabilities, resources, image tag)
• submissions/lab9.md: full lab submission with Falco alerts, custom rules, Conftest results, and tuning discussion

Testing

docker exec lab9-target /bin/sh -lc 'echo "shell-in-container test"'
grep "Terminal shell" labs/lab9/falco/logs/falco.log | head -1

docker exec lab9-target /bin/sh -lc 'echo "test" > /tmp/my-write.txt'
grep "Write to /tmp" labs/lab9/falco/logs/falco.log | tail -1

conftest test -p labs/lab9/policies/extra/ labs/lab9/manifests/k8s/juice-hardened.yaml

conftest test -p labs/lab9/policies/extra/ labs/lab9/manifests/k8s/juice-unhardened-deployment.yaml

• Task 1 — 2 baseline + 1 custom Falco alert with tuning discussion
• Task 2 — ≥3 Conftest rules, passing on good manifest, failing on bad
• Bonus — Cryptominer detection rule with triggered alert