[codex] Polish auth noise and Zeek timing realism

[DavidJBianco]

Summary

• Add overlay-backed auth_noise.yaml config plus schema and eforge validate-config coverage for stale scheduled-credential noise.
• Replace rigid stale service-account failure cadence with deterministic irregular intervals, jitter, skips, and backoff.
• Emit source-port-matched Zeek SSH tuples for remote Linux failed-password syslog events.
• Diversify generator-owned Zeek duration anchors while preserving caller-authored durations and DNS RTT locks.
• Update docs, skill references, installed Codex skill copies, TODO, and regression tests.

Validation

• uv run eforge validate-config
• uv run ruff check .
• uv run ruff format --check .
• uv run pytest -q (3019 passed, 15 skipped)
• uv run pytest -v --include-slow (3033 passed, 1 skipped)
• Installed eforge-* Codex skill quick validation