test: pin pam_unix_session_closed parser coverage telemetry

[VedantMadane]

Summary

Review trace for #83: the first pam_unix(sshd:session) session-close sample in the mixed auth corpus.

Fixture line under review

assets/mixed_auth_corpus.log line 11:
ext Mar 12 08:00:41 ubuntu-auth-01 pam_unix(sshd:session): session closed for user user001

Confirmation

Already matches assets/mixed_auth_parser_coverage.json:

• category: unsupported_pam_variant
• reason: unrecognized auth pattern: pam_unix_session_closed
• no parsed event; no detector findings

No fixture correction needed. This PR adds an explicit regression pin and a short ROADMAP note so the contract stays visible.

Test plan

• test_mixed_auth_first_pam_unix_session_closed_is_unsupported_telemetry (manual g++ build of test_parser)

Fixes #83

[stacknil]

Final maintainer review after CI:

• Design decision: keep the first checked-in pam_unix(sshd:session) close sample as parser coverage telemetry and pin its exact corpus-line-to-artifact mapping; it must not become an Event or detector finding.
• Main risk: the regression intentionally couples this assertion to corpus line 11, so future fixture reordering must update the pin together with the committed coverage artifact.
• Compatibility impact: none for the parser, detector, CLI, report schemas, fixtures, or runtime dependencies; this is test and roadmap coverage only.
• Rollback path: revert the merge commit to remove the explicit pin without changing current runtime behavior.

Validation: local MSVC Release build with warnings-as-errors, targeted parser CTest 1/1, full CTest 6/6, git diff --check, changed-line privacy/secret scan, plus all GitHub CI, fuzz, CodeQL, and Repo Sentinel checks passed.