security-monitoring.md: agent count and roster refreshed to 12

Live re-ran agent_control -l against the real Wazuh manager - the
netbird host (ID 013) is now enrolled and Active, matching the fleet's
real current host count.

docs/security-monitoring.md

@@ -6,7 +6,7 @@
 | | |
 |---|---|
 | **Software** | Wazuh (manager/indexer/dashboard), self-hosted |
-| **Coverage** | 11 active agents, one per fleet host, no gaps |
+| **Coverage** | 12 active agents, one per fleet host, no gaps |
 | **Detection layers** | Compliance scoring (SCA) · file integrity monitoring (syscheck) · rootkit/anomaly heuristics (rootcheck) |
 | **Runbook** | 10+ recurring alert types root-caused once, documented, never re-triaged from scratch |
 | **Query path** | Direct index queries, bypassing the SOC dashboard entirely when needed |
@@ -27,6 +27,7 @@ ID: 009, Name: vault, IP: any, Active
 ID: 010, Name: caddy, IP: any, Active
 ID: 011, Name: technitium, IP: any, Active
 ID: 012, Name: file-server, IP: any, Active
+ID: 013, Name: netbird, IP: any, Active
 ```
 
 ## Why agent-based, and why self-hosted
@@ -116,4 +117,4 @@ The authentication stack is configured to fail **safe** under a specific failure
 > The fleet's automated security-benchmark tool (Docker Bench for Security) runs as a **native binary**, not through its own official container image — that image hit a real binary-compatibility wall between two different C library implementations (glibc vs. musl) that made it fail to run reliably. Running it natively instead of debugging a broken official container was the pragmatic call: the tool's job is auditing Docker, not testing container-runtime compatibility edge cases. It runs weekly, deliberately timed against real observed cron load from the other scheduled jobs described in [`docs/cron-scheduler.md`](cron-scheduler.md), rather than an arbitrary default schedule that might collide with heavier jobs.
 
 ---
-Related: [`docs/firewall-and-network.md`](firewall-and-network.md), [`docs/dashy-soc-board.md`](dashy-soc-board.md), [`docs/notifications.md`](notifications.md), [`docs/iac-pipeline.md`](iac-pipeline.md) · Stacks: [`stacks/identity-and-security/wazuh/`](../stacks/identity-and-security/wazuh/)
+Related: [`docs/firewall-and-network.md`](firewall-and-network.md), [`docs/dashy-soc-board.md`](dashy-soc-board.md), [`docs/notifications.md`](notifications.md), [`docs/iac-pipeline.md`](iac-pipeline.md), [`docs/netbird-zero-trust.md`](netbird-zero-trust.md) · Stacks: [`stacks/identity-and-security/wazuh/`](../stacks/identity-and-security/wazuh/)