feat(plugins): distribute ingestion ownership across event-processor workers

[yllada]

What

The four pull-based ingestion plugins (aws, o365, crowdstrike, sophos) now run in
worker mode and coordinate ownership over NATS JetStream, so multiple
event-processor replicas no longer duplicate or drop work.

• New plugins/shared module: lease store, cursor store, job queue, scheduler.
• Lease path (aws, crowdstrike): a worker acquires a per-unit lease before
  streaming, renews it on a heartbeat, and stops as soon as it is fenced.
• Queue path (o365, sophos): one elected scheduler publishes a job per group
  per tick; any worker may consume it.
• The ingestion position moves from an in-memory variable to a persisted
  per-group cursor.
• Event ids are derived from the event's own fields instead of a fresh UUID.

Why

Each replica used to run the full ingestion loop independently, and the position
lived in a local variable: on restart a plugin resumed at now - interval, so
anything that arrived while it was down was never read. Persisting the cursor
lets a replica resume where the previous one stopped; the lease and queue paths
decide which replica does the work.

On failover the design prefers re-reading over skipping — a duplicate is noise,
a gap is an attack nobody saw. Deterministic event ids are what keep those
re-reads recognisable.

[github-actions]

✅ AI review — Clean

No issues detected in this diff.

✅ architecture (gemini-3-flash-lite) — clean

Summary: Routine dependency bumps and added NATS-based distributed coordination and cursor management modules for AWS, CrowdStrike, O365, and Sophos plugins.

No findings.

✅ bugs (gemini-3-flash-lite) — clean

Summary: Distributed coordination and cursor management integration for AWS, CrowdStrike, O365, and Sophos plugins using JetStream.

No findings.

✅ security (gemini-3-flash-lite) — clean

Summary: Routine refactoring and addition of NATS coordination/cursor features to AWS, CrowdStrike, O365, and Sophos plugins.

No findings.

🔴 go-deps — pending updates

🔍 Discovered 31 Go projects

📦 Dependencies with updates available:

  📁 ./plugins/crowdstrike:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/azure:
     - github.com/Azure/azure-sdk-for-go/sdk/azcore: v1.23.0 → v1.23.1
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/soc-ai:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/events:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/gcp:
     - cloud.google.com/go/pubsub: v1.51.0 → v1.51.1
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/api: v0.293.0 → v0.296.0

  📁 ./plugins/bitdefender:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/o365:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/rule-flood-guard:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/shared:
     - golang.org/x/crypto: v0.49.0 → v0.55.0

  📁 ./plugins/stats:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/feeds:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/geolocation:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/playground:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/soar:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/sophos:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./plugins/alerts:
     - github.com/threatwinds/go-sdk: v1.1.27-0.20260811073440-251cb9d842cd → v1.1.31

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2: v1.43.6 → v1.45.1
     - github.com/aws/aws-sdk-go-v2/config: v1.32.37 → v1.33.1
     - github.com/aws/aws-sdk-go-v2/credentials: v1.19.36 → v1.20.1
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.82.2 → v1.84.1
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./log-input:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.2

  📁 ./backend:
     - cloud.google.com/go/pubsub: v1.51.0 → v1.51.1
     - github.com/aws/aws-sdk-go-v2/config: v1.32.36 → v1.33.1
     - github.com/aws/aws-sdk-go-v2/credentials: v1.19.35 → v1.20.1
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.45.5 → v1.47.1
     - google.golang.org/api: v0.293.0 → v0.296.0
     - google.golang.org/grpc: v1.83.0 → v1.83.2

  📁 ./collectors/collector:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.2

  📁 ./collectors/forwarder:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.2

  📁 ./collectors/as400:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.2

  📁 ./collectors/utmstack:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.2

  📁 ./tools/rulecheck:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31

  📁 ./agent-manager:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.2

  📁 ./agent:
     - github.com/threatwinds/go-sdk: v1.1.28 → v1.1.31
     - google.golang.org/grpc: v1.83.0 → v1.83.2

❌ Please update dependencies before merging.