feat(ebpf): Add file, network, memory, and process-control syscall telemetry

[mostafa]

What is the purpose of this PR / why it is needed?

Expands the Linux eBPF source beyond the process vertical slice to the MVP syscall matrix: openat (with open/openat2), unlink/unlinkat, rename/renameat/renameat2, connect, accept/accept4, mmap, process_vm_readv/process_vm_writev, kill/tkill/tgkill, ptrace, and prctl. Each family lives in its own BPF program object sharing the ring buffer, scratch, and enabled-type maps through MapReplacements.

The shared syscall_event record grows generic argument slots, a second path buffer, and truncation bits. Enter-state is staged in a per-CPU heap array (two 256-byte paths exceed the BPF stack) and correlated to the exit through a global LRU hash keyed by pid_tgid: the task can migrate CPUs mid-syscall, so the correlation map cannot be per-CPU, and LRU eviction reclaims entries whose exit never fires. Sockaddr copies clamp to the caller's addrlen because a fixed-size read past the buffer can cross into an unmapped page and fail wholesale; accept reads the value-result addrlen and peer address at exit. Emission is gated in the kernel by an enabled-type array populated from the event source config, so disabled families cost neither ring buffer traffic nor userspace decode.

Successful mmap calls update the process state with the new mapping (base, size, protection, anonymous or file-backed kind).

What type of change does this PR introduce?

---

/kind feature

Any specific area of the project related to this PR?

---

/area instrumentation

/area telemetry

/area tests

Special notes for the reviewer

---

• Integration base is linux-port, not master.
• Stable semantic type IDs 4-14 extend the Linux catalog; the raw syscall number stays an event parameter, so openat/openat2/open all map to one openat event.
• Process-control events (kill, ptrace, prctl) are always captured with the process family. File, network, and memory families follow enable-fileio, enable-net, and enable-mem, enforced twice: tracepoints are not attached, and the kernel-side enabled map stays zero.
• Only legacy syscall tracepoints (open, unlink, rename, tkill, and the existing fork/vfork) are optional attachments, following the earlier finding that some kernels refuse perf links on them. Modern variants (openat2, renameat2, accept4, tgkill) must attach.
• Scratch entries are deleted on every exit path, including ring-buffer-full reserve failures.
• Objects regenerated with Ubuntu 24.04 clang 18 to match the drift check.
• Verified:
  • Docker Linux: ./internal/ebpf/generate.sh followed by a clean git diff -- internal/ebpf
  • Docker Linux: go test ./internal/ebpf/... ./pkg/event/...
  • Matrix test asserts every catalog type decodes its documented parameters; live integration test covers openat, rename, unlink, and kill end to end.

Does this PR introduce a user-facing change?

---

Yes. On a 5.9+ kernel with runtime BTF, fibratus run now emits file, network, memory, and process-control syscall events alongside process telemetry, honoring the enable-fileio, enable-net, and enable-mem event source settings.