add deploy-stack skill; falco: fix hook-tamper condition, add three more post-incident rules

git-hook-tamper.yaml's condition used proc.exepath, which resolves to the
script interpreter's path (e.g. /bin/busybox) for shebang scripts, not the
script's own path - switched to proc.cmdline, which retains the originally
invoked path. Confirmed via live-testing both ways.

ssh-persistence/cloud-metadata-probe/db-spawned-process round out the
post-incident hardening pass with a few more incubating-ruleset adaptations.

falco/rules/git-hook-tamper.yaml

@@ -19,7 +19,7 @@
   condition: >
     spawned_process
     and container.name = "gitea"
-    and proc.exepath contains "/hooks/"
+    and proc.cmdline contains "/hooks/"
     and not proc.name in (gitea_managed_hook_names)
   output: >
     Unexpected git hook executed