falco/netdata: tune out obsidian/ttyd/ollama noise, fix swap alarm flapping

No repeat intrusion - investigated all Falco alerts since deployment
(2026-08-08 to 2026-08-16); the only crypto-miner rule hits were the
original test alerts. The daily self-resolving Telegram alerts the user
was seeing came from four known-benign sources: Obsidian's Electron
self-re-exec pattern and s6-init sudoers setup (fires ~daily on container
recreation), ttyd/Synchronet's telnet/pv/busybox-extras BBS tooling, and
ollama's nvidia-ctk ldconfig-refresh hook (memfd_create by design). Added
scoped exceptions for each via Falco's own rule extension points, same
pattern as the earlier pg_isready/gitea fixes.

Also fixed netdata's used_swap alarm, which recalculated from the
instantaneous raw sample every 10s with only a 30s notification debounce -
a brief swap spike was enough to page both Telegram and (via Netdata
Cloud) email. Widened the up-delay to 5m so only sustained swap pressure
notifies.

Verified end-to-end via a fresh fake-xmrig test after redeploying Falco
and reloading netdata: CRITICAL alarm fired and Telegram delivery
succeeded.

netdata/health.d/swap.conf

@@ -0,0 +1,24 @@
+# Override of netdata's stock used_swap alarm (health.d/swap.conf). The
+# stock template recalculates $used/$free from the *instantaneous* raw
+# sample every 10s with only a 30s notification debounce, so a swap spike
+# lasting a couple of minutes was enough to page. Only the delay line
+# changes here (up 30s -> up 5m) - the rest is copied verbatim from the
+# stock template since netdata health.d overrides replace the whole
+# template, not just one line. This requires sustained swap pressure
+# (5+ continuous minutes above threshold) before notifying, instead of
+# firing on every brief spike.
+   template: used_swap
+         on: mem.swap
+      class: Utilization
+       type: System
+  component: Memory
+host labels: _os=linux freebsd
+       calc: (($used + $free) > 0) ? ($used * 100 / ($used + $free)) : 0
+      units: %
+      every: 10s
+       warn: $this > (($status >= $WARNING)  ? (80) : (90))
+       crit: $this > (($status == $CRITICAL) ? (90) : (98))
+      delay: up 5m down 15m multiplier 1.5 max 1h
+    summary: System swap memory utilization
+       info: Swap memory utilization
+         to: sysadmin