add deploy-stack skill; falco: fix hook-tamper condition, add three more post-incident rules

git-hook-tamper.yaml's condition used proc.exepath, which resolves to the
script interpreter's path (e.g. /bin/busybox) for shebang scripts, not the
script's own path - switched to proc.cmdline, which retains the originally
invoked path. Confirmed via live-testing both ways.

ssh-persistence/cloud-metadata-probe/db-spawned-process round out the
post-incident hardening pass with a few more incubating-ruleset adaptations.

falco/docker-compose.yaml

@@ -34,3 +34,6 @@ services:
       - ./rules/tune-noise.yaml:/etc/falco/rules.d/tune-noise.yaml:ro
       - ./rules/git-hook-tamper.yaml:/etc/falco/rules.d/git-hook-tamper.yaml:ro
       - ./rules/unexpected-child-of-git.yaml:/etc/falco/rules.d/unexpected-child-of-git.yaml:ro
+      - ./rules/ssh-persistence.yaml:/etc/falco/rules.d/ssh-persistence.yaml:ro
+      - ./rules/cloud-metadata-probe.yaml:/etc/falco/rules.d/cloud-metadata-probe.yaml:ro
+      - ./rules/db-spawned-process.yaml:/etc/falco/rules.d/db-spawned-process.yaml:ro