Bucket PAM faillock account-lock telemetry

[stacknil]

Summary

• split pam_faillock(...): Account temporarily locked for user ... into the stable pam_faillock_account_locked telemetry bucket instead of the generic pam_faillock_other bucket
• update parser fixture assertions and docs so unsupported account-lock evidence remains reviewable without becoming detector evidence
• print test_cli assertion messages to stderr so Windows CLI test failures are diagnosable in CI output

Validation

• cmake --build build --config Debug --target test_parser
• ctest --test-dir build -C Debug -R parser --output-on-failure
• cmake --build build --config Debug
• ctest --test-dir build -C Debug --output-on-failure
• git diff --check
• diff scans for local paths, secret assignment patterns, private-key markers, and non-documentation IP addresses

Safety

• No new parsed event type or detector signal mapping.
• This remains telemetry-only for unsupported pam_faillock account-lock lines.
• Existing fixture lines use example-host and 203.0.113.x documentation addresses only.