feat(data_library): add journald sample package

[chelseawright7]

Proposed Change

Adds data_library/journald/journal_json.log — 16 journalctl -o json records across the syslog, stdout, journal, kernel and driver transports: sshd auth success/failure/lockout, nginx worker exit and upstream refusal, systemd unit failure, sudo (authorized and NOT-in-sudoers), a UFW block, an OOM kill, cron, dockerd, postgres, and journald rate-limit suppression.

Journald had no Blitz coverage at all before this.

Fields use raw journald names (_PID, _EXE, MESSAGE, PRIORITY, SYSLOG_IDENTIFIER, _HOSTNAME) rather than OpenTelemetry-conventional ones, which is what the OTel journald receiver actually delivers — and what makes the sample useful to a pipeline whose job is renaming them.

One limitation, documented in docs/generator/filegen.md: journald's canonical timestamp __REALTIME_TIMESTAMP is epoch microseconds, which has no ctime directive, so those values are static. Syslog-transport records also carry SYSLOG_TIMESTAMP, which does use a directive and advances per emission.

Checklist

• Changes are tested
• CI has passed

go build ./..., go test ./..., make lint and make security pass, as does go build/go test under -tags embed_library.

Smoke-tested through the CLI:

blitz --generator-type filegen --generator-filegen-source package:journald \
      --output-type stdout --generator-count 3

Confirms the package resolves by name and that SYSLOG_TIMESTAMP directive substitution advances per emission.

---

Per review: the hostmetrics process scraper that was originally in this PR has been split out into #295. This PR is now journald only.

[Dylan-M]

Please remove the process scraper. PRs should be for a single feature/capability. The JournalD work looks pretty good, but cannot be co-merged with the process work.

[Dylan-M]

Details inline

[Dylan-M]

__REALTIME_TIMESTAMP is hardcoded to fixed epoch-microsecond values. It doesn't advance per emission the way the ctime directives everywhere else in the library do. The journald receiver keys record time off this field, so every run replays the same 2026 timestamps. Once the %EPOCH_US directive lands (see #296), I'd use it here so this renders live epoch microseconds. The other 15 lines need the same change.