Auditd: Watch Sensitive Files

Compliance requires an audit trail on changes to two sensitive files on this host. Read /root/case/assignment.env for the two paths (WATCH_A, WATCH_B) and the audit key you must tag them with (AUDIT_KEY). Add persistent auditd watch rules — the kind that live in /etc/audit/rules.d/ and load at boot — so that writes and attribute changes to both files are recorded under your assigned key. Grading reads the durable rules files (what auditctl loads and 'auditctl -l' would show), so the rules on disk are what must be correct.