falco: add cryptominer/runtime-security scanner wired into netdata

Detects unauthorized miners (and other runtime threats) via Falco's
syscall/eBPF monitoring, following the 2026-08-06 gitea/xmrig
compromise. Wired into netdata rather than a new notification channel:
Falco exposes a Prometheus /metrics endpoint, netdata scrapes it, and a
new health.d alarm pages through netdata's already-configured Telegram
bot - no new alerting infra needed.

Includes a custom process-name rule for known miner binaries (the stock
Stratum-protocol rule wouldn't have caught the actual gitea incident,
which used a bare host:port with no scheme prefix), an outbound
miner-pool-port rule as a second layer, and rule_matching: all in the
Falco config - without it, Falco silently drops all but the first
matching rule per event, which would have suppressed our custom rule
whenever a stock rule also matched the same process.

falco/rules/miner-detect.yaml

@@ -0,0 +1,27 @@
+# Custom rule: catch known cryptominer binaries by process name directly.
+# Added after the 2026-08-06 gitea/xmrig compromise, where the miner was
+# invoked as `--url=host:port` with no "stratum+tcp" scheme prefix, which
+# would NOT have matched Falco's stock "Detect crypto miners using the
+# Stratum protocol" rule. Matching the binary name is the reliable signal.
+
+- list: miner_binary_names
+  items: [
+    xmrig, xmrig-notls, xmr-stak, xmr-stak-cpu, xmr-stak-rx,
+    minerd, cpuminer, ccminer, cgminer, bfgminer,
+    nanominer, t-rex, trex, teamredminer, phoenixminer, lolminer,
+    ethminer, nbminer, gminer, srbminer, xmrigMiner,
+  ]
+
+- rule: Detect crypto miner binary execution
+  desc: >
+    A process matching a known cryptocurrency miner binary name was executed.
+    Catches unauthorized miners even when the command line doesn't use a
+    stratum+tcp:// style URL.
+  condition: >
+    spawned_process and proc.name in (miner_binary_names)
+  output: >
+    Cryptominer binary execution detected
+    (user=%user.name command=%proc.cmdline container=%container.name
+    image=%container.image.repository pid=%proc.pid)
+  priority: CRITICAL
+  tags: [miners, process, mitre_impact]