fix(collector): use word-boundary matching for dmesg severity

dmesgSeverity classified a kernel log line as Critical via plain
strings.Contains, without word boundaries, so common words that merely
contain a keyword as a substring false-positive — "disabled by
default" was flagged Critical because "default" contains "fault"
(de-fault). Found in a support bundle where 140/238 event_logs entries
came back Critical, most of them harmless boot messages (module load
notices, "... is initialized", "disabled by default"), drowning out
genuinely critical entries (Xid, AER, ECC) in the same list.

Switch to the same \b-bounded regexes already used for the capture
patterns above it in this file.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

audit/internal/collector/dmesg_events.go

@@ -108,6 +108,23 @@ func matchesAny(s string, patterns []*regexp.Regexp) bool {
 	return false
 }
 
+// dmesgSeverityCriticalPatterns use \b word boundaries, unlike a plain
+// strings.Contains check, so common words that merely contain a keyword as a
+// substring don't false-positive — e.g. "disabled by default" contains
+// "fault" (de-fault), and "undead" would contain "dead".
+var dmesgSeverityCriticalPatterns = []*regexp.Regexp{
+	regexp.MustCompile(`(?i)\bpanic\b`),
+	regexp.MustCompile(`(?i)\baer\b`),
+	regexp.MustCompile(`(?i)\buncorrect`),
+	regexp.MustCompile(`(?i)\bxid\b`),
+	regexp.MustCompile(`(?i)\bnvrm\b`),
+	regexp.MustCompile(`(?i)\berror\b`),
+	regexp.MustCompile(`(?i)\bfault\b`),
+	regexp.MustCompile(`(?i)\bfail(ed|ure)?\b`),
+	regexp.MustCompile(`(?i)\bdead\b`),
+	regexp.MustCompile(`(?i)\bhang\b`),
+}
+
 func dmesgSeverity(msg string) string {
 	if sev, ok := XidSeverity(msg); ok {
 		if sev == "critical" {
@@ -115,21 +132,8 @@ func dmesgSeverity(msg string) string {
 		}
 		return statusWarning
 	}
-	lower := strings.ToLower(msg)
-	switch {
-	case strings.Contains(lower, "panic") ||
-		strings.Contains(lower, "aer") ||
-		strings.Contains(lower, "uncorrect") ||
-		strings.Contains(lower, "xid") ||
-		strings.Contains(lower, "nvrm"):
+	if matchesAny(msg, dmesgSeverityCriticalPatterns) {
 		return statusCritical
-	case strings.Contains(lower, "error") ||
-		strings.Contains(lower, "fault") ||
-		strings.Contains(lower, "fail") ||
-		strings.Contains(lower, "dead") ||
-		strings.Contains(lower, "hang"):
-		return statusCritical
-	default:
-		return statusWarning
 	}
+	return statusWarning
 }