Build Week: Preserve SOG correlation IDs in Argus

[CodeBuildder]

Summary

Preserves an explicit cross-agent correlation ID when Argus publishes accepted Falco evidence to the Sentinel Operations Graph (SOG).

Why

Argus findings previously had stable event IDs but no way to participate in a larger Sentinel incident lifecycle. Sentinel therefore could display adjacent Argus and Phoenix records without being able to prove they belonged to the same causal case.

Changes

• accepts correlation_id from the webhook envelope
• accepts sentinel.correlation_id from normalized Falco fields
• forwards the ID unchanged in the SOG finding contract
• labels native Falco evidence as observed
• keeps correlation optional; standalone findings never fabricate incident membership
• adds a contract test for identity preservation and provenance

Verification

• 11 passed in agent/tests/test_world_model.py
• git diff --check passed

Cross-repository phase

Producer portion of CodeBuildder/sentinel#52. Phoenix publishes the corresponding healing lifecycle identity, while Sentinel forms a case only when both specialist agents explicitly share it.

Closes #108