perf(windows-etw): cut quiet-host alert latency

[Karib0u]

Summary

• request an ETW partial-buffer handoff every 100 ms by default, configurable with windows.etw_flush_interval_ms
• pause forced handoffs when the 8,192-event sensor queue reaches 50%, where downstream queueing controls latency
• keep the existing 256 KB x 64-128 ETW buffer pool unchanged
• use aligned storage for the variable-length ControlTraceW properties blocks
• fix the Windows benchmark trigger to run whoami /all, matching its generated Sigma rule
• document the setting against the consolidated documentation from current main

Set windows.etw_flush_interval_ms = 0 to restore ETW's native one-second timer. Values from 1 to 19 ms are clamped to 20 ms.

Windows lab results

Windows 11 VM, 6 vCPU, 8 GB. Latency is measured from immediately before whoami /all to Rustinel's timestamped Detection triggered record, avoiding the harness's 100 ms alert-file polling granularity.

15 quiet-host runs per setting with 11 Sigma rules:

Forced handoff	Median	Mean	p95 / max
disabled	483 ms	604 ms	1,013 ms
250 ms	125 ms	124 ms	238 ms
100 ms	77 ms	66 ms	101 ms
50 ms	27 ms	24 ms	45 ms
20 ms	10 ms	11 ms	22 ms

With 2,599 Sigma rules after 500 sequential process launches, 100 ms flushing produced a 61 ms median versus 259 ms disabled. The sensor queue high-water mark was 64, so this case was not queue-bound.

A 2,000-file burst raised the queue high-water mark to 4,801/8,192 with zero drops and showed no clear flush benefit, as expected. A deliberately excessive 5,000-file burst saturated the queue and confirmed that forced flushing does not solve downstream backpressure. The 50% guard stops explicit flush requests in that state.

Idle process CPU over 60 seconds remained below 0.4% of one core at every tested interval, with no monotonic increase attributable to flushing.

Validation

• cargo test --locked --lib (309 passed)
• cargo clippy --locked --all-targets -- -D warnings
• Windows: cargo test --locked --no-run
• Windows: cargo test --locked sensor::windows::flush::tests (3 passed)
• Windows: cargo build --locked --release
• Windows default-config smoke test: 20-70 ms across five runs
• Windows disabled smoke test: 133-1,001 ms across five runs