[Change] monitor: observability for 100%-filtered cycle; issue #485

[Change] Emit eout log line when _event_count > 0 but _tot_files == 0
         (every queued event dropped by tier-2 size/ext/perm/owner find
         filter) so operators can self-diagnose silent no-scan cycles
         without enabling verbose logging.

Author: rfxn

CHANGELOG

@@ -84,6 +84,8 @@ v2.0.1 | Mar 25 2026:
 
   -- Changes --
 
+[Change] monitor: log filtered-cycle event count when all events dropped by
+         tier-2 scan filter (_event_count > 0 but _tot_files == 0); issue #485
 [Change] Vendored libs synced to canonical: tlog_lib 2.0.6, alert_lib 1.0.7, elog_lib 1.0.6, pkg_lib 1.0.10 (zero functional change)
 [Change] Alert templates: consolidate summary into headers; drop "TOTAL" prefix from
          labels (HITS/CLEANED/QUARANTINED); add quarantine metrics; aligned column spacing

CHANGELOG.RELEASE

@@ -84,6 +84,8 @@ v2.0.1 | Mar 25 2026:
 
   -- Changes --
 
+[Change] monitor: log filtered-cycle event count when all events dropped by
+         tier-2 scan filter (_event_count > 0 but _tot_files == 0); issue #485
 [Change] Vendored libs synced to canonical: tlog_lib 2.0.6, alert_lib 1.0.7, elog_lib 1.0.6, pkg_lib 1.0.10 (zero functional change)
 [Change] Alert templates: consolidate summary into headers; drop "TOTAL" prefix from
          labels (HITS/CLEANED/QUARANTINED); add quarantine metrics; aligned column spacing

files/internals/lmd_monitor.sh

@@ -376,6 +376,7 @@ _monitor_cycle_tick() {
 	_tot_files=$($wc -l < "$_filtered_list" 2>/dev/null) || _tot_files=0
 	if [ "$_tot_files" -eq 0 ]; then
 		command rm -f "$_filtered_list"
+		eout "{mon} filtered $_event_count event(s) — none passed scan filter"
 		_monitor_housekeeping
 		return
 	fi