test(common): add feature-isolation checks and contract tests

[Daniele-Cangi]

Description

This is the first hermetic slice of #198 and a focused follow-up to the shared-structure work tracked by #158.

It adds fast feature-isolation coverage for cortexbrain-common, fixes the two monitoring cfg leaks exposed by that matrix, and adds public eBPF/userspace contract tests for event layouts, protocol conversion, and address conversion.

Metadata, service-cache, and service-discovery files are intentionally untouched to avoid interfering with #216.

What changed

• Add an eight-case cargo check matrix covering no features, the individual event-structure features, each meaningful buffer-reader pairing, the handler pairing, the runtime feature set, and all features.
• Gate the SslEvent aya::Pod implementation with monitoring-structs.
• Gate the SSL consumer method with monitoring-structs so buffer-reader,network-structs remains isolated.
• Add hermetic integration tests for:
  • C/packed event sizes, alignments, and field offsets that form the userspace/eBPF contract;
  • aya::Pod, bytemuck::Zeroable, and Copy requirements;
  • ICMP/TCP/UDP conversion and unknown protocol fallback;
  • deterministic IPv4 and IPv6 address conversion.

The new checks require no Docker daemon, Kubernetes cluster, root access, privileged container, loaded eBPF program, /sys/fs/bpf, network topology, or external service.

Type of Change

• Bug fix
• Tests / CI
• Documentation update
• Code refactoring

Validation

• All eight locked cortexbrain-common feature checks pass.
• cargo check --locked -p cortexbrain-common --all-targets --all-features passes.
• public_contracts: 7 passed, 0 failed.
• Focused rustfmt check passes for all changed Rust files.
• Workflow YAML parses successfully.

The repository-wide cargo fmt --manifest-path core/Cargo.toml --all --check remains blocked by pre-existing missing generated bindings.rs modules and unrelated formatting drift; this PR does not alter those files.

Refs #198

Refs #158