fix(agent): FIM baseline advanced for unreported change deltas

[cursor]

Bug and impact

Full-scope FIM permanently lost change events whenever a scan produced more deltas than fim_max_changes (default 500), or when the ~1.5MiB report marshal trimmed file_changes further. Overflowed adds/modifies/deletes were merged into the on-disk baseline anyway, so later scans treated them as already acknowledged and never emitted them.

Trigger: mass package update, bulk delete, or large config rollout on a host with FIM full scope enabled → first scan reports ≤500 changes (or ≤200 after size trim) and silently drops the rest forever.

Root cause

collectFIMChanges truncated the reported slice in fimDiffBaseline, then advanced the baseline with the full cur map and every visited deletion. The transport size cap in module_host_security.go could drop even more entries after that save.

Fix

• Advance baseline only for unchanged / first-visit seeds and paths present in the reported change list.
• Stage merge inputs so a later transport trim can re-commit with the final acknowledged set.
• Regression tests for maxChanges overflow and transport re-commit.

Validation

• go test -count=1 -run 'TestCollectFIM|TestFIM|TestFim' ./cmd/agent/
• go build ./cmd/agent ./cmd/server

Note

PR #30 (alert_history retention/resolve) is still open and unrelated: #30