Periodic host+container sweep for the exact indicators seen in the staging
miner incident: decoy process names (redis-server/kworkerd/xmrig/ssl_client/
init.sh), /tmp/.kworkerd and .redis-server.pid artifacts, and high-CPU
containers. Findings are logged and exit 1 for cron MAILTO alerting.
Closes MITHOME-82