False positive: Rule 600005 (macOS kernel panic) matches benign Docker Desktop QEMU parameter `panic=0`

### Summary

A level‑12 alert (`600005 – macOS: Critical kernel panic or fatal error detected`) is incorrectly triggered on a **Linux** agent when Docker Desktop launches its internal QEMU virtual machine. The alert is caused by the safe kernel boot parameter `panic=0`, which appears in the QEMU command line.

### Environment

- **Agent OS:** Linux (hostname: `said-ws`, ID: `037`)
- **Agent software:** Docker Desktop with internal QEMU/linuxkit VM
- **Log source:** `/var/log/syslog`
- **Wazuh manager:** 4.x

### Example alert (full_log)
```
2026-07-28T07:41:37.149202+01:00 said-ws com.docker.backend[688774]: ... -append init=/initd ... panic=0 ... console=ttyS0 ...
```

The keyword `panic=0` is part of the QEMU `-append` kernel arguments – it tells the Linux kernel to halt on panic, not reboot. No actual panic or kernel fault has occurred.

### Alert produced

- **Rule ID:** 600005
- **Level:** 12
- **Description:** `macOS: Critical kernel panic or fatal error detected`
- **Groups:** `macos, syslog, kernel, system_error`
- **Compliance:** PCI DSS, GDPR, HIPAA, etc. (inherited)

### Root cause

The rule’s PCRE2 regex `(?:panic|kernel\s+trap|fatal(?:\s+error)?|critical(?:\s+error)?)` matches the substring `panic` anywhere in the log. It does not exclude the safe kernel parameter `panic=0`, and it applies to all agents regardless of operating system.

### Expected behaviour

- `panic=0` in a kernel command line should **never** trigger a kernel panic alert.
- Docker Desktop’s QEMU start‑up messages should be excluded, or the rule should be restricted to macOS agents.

Start by locating rule 600005 and inspecting its PCRE2 matching against the provided syslog example. Reproduce the Docker Desktop QEMU message, then verify that panic=0 no longer alerts while a genuine macOS kernel panic still does; check the relevant rule validation or alert tests if present.

Escrito por el modelo de indexación a partir del texto del issue.