Implement thread hijacking detection with context inspection

- Added thread context inspection (RIP/EIP register analysis)
- Detect threads executing from RWX memory regions
- Detect threads in unbacked/private memory
- Thread start address vs current IP divergence detection
- Suspended thread analysis
- Support for both x86 and x64 architectures
- Cross-platform stubs for Linux/macOS

Detects MITRE ATT&CK T1055.003 (Thread Execution Hijacking).

Generated with [Claude Code](https://claude.com/claude-code)

ghost-core/src/lib.rs

@@ -106,7 +106,7 @@ pub use streaming::{
     Alert, AlertManager, AlertRule, CorrelationEngine, EventChannel, EventSeverity,
     EventStreamingSystem, EventType, NotificationSystem, StreamingEvent,
 };
-pub use thread::ThreadInfo;
+pub use thread::{detect_thread_hijacking, HijackedThreadInfo, ThreadHijackingResult, ThreadInfo};
 pub use threat_intel::{
     Campaign, IndicatorOfCompromise, IocType, SophisticationLevel, ThreatActor as ThreatIntelActor,
     ThreatContext, ThreatIntelligence,