feat(bpf): userspace ring-buffer reader + decoder + per-probe attach + gone-pid guard fix

[ebenali]

Wires the kernel birth program to userspace. Stacked on #62 — GitHub will retarget this to master once #62 merges.

What

• backend/linux/BpfBirthReader.{h,cpp} (gated on QIFTOP_HAVE_BPF): loads the CO-RE skeleton, attaches the fexit/fentry probes, drains the ring buffer on a dedicated std::thread, feeds each birth to a Sink. Routes libbpf logging into the verbose category.
• backend/linux/BirthDecode.h: the PURE wire-event → BirthKey/BirthRecord decoder (no kernel/libbpf, always built + tested). Network-order bytes → QHostAddress (v4/v6), host-order ports, IANA proto → L4Proto, direction byte → Direction, start_boottime_ns → /proc field-22 clock ticks via sysconf(_SC_CLK_TCK). Pinned by test_birth_decode.
• Per-probe tolerant attach: each program attached individually (bpf_program__attach); the ones that take are kept, so a kernel where one traced function is renamed/inlined/non-attachable still yields births from the rest. start() succeeds if ≥1 attaches (logs attached N/M probes). We own + free the links.
• Correctness fixes to the merged scaffolding:
  • start_time → start_boottime capture (the field /proc field-22 derives from — verified against fs/proc/array.c), so the PID-reuse guard's equality check is sound.
  • PID-reuse guard now serves a GONE pid (live==0) instead of rejecting it — that's exactly the short-lived process the hybrid exists to catch. Rejects only when a DIFFERENT live process holds the pid. Test flipped (goneShortLivedPidIsServed).

Validation

• Unit: full build + 44/44 tests + clang-tidy gate clean (HAVE_BPF on); skip-safe off-build verified (reader → empty TU).
• Graceful degradation proven on a BTF-less kernel (the dev box): start() returns false + inert, no crash, both unprivileged (memlock EPERM) and root (BTF missing).
• End-to-end on a real BTF kernel (Vagrant Ubuntu 6.8) — built with BPF on, ran a load harness:

  bpf birth: attached 4/4 probes; draining ring buffer
  [OURS] pid=3297 comm=bpf_vmtest dir=outbound 192.168.121.122:43030 -> 1.1.1.1:80 proto=Tcp
         pid=3300 comm=curl       dir=outbound ...:43046 -> 1.1.1.1:80
  RESULT: total_births=3  ours=2  exit 0
  

  Our own connect()s attributed to the right pid/comm/tuple/direction, and the short-lived curl child captured — the conntrack gap, closed.

Next

Factory wiring (construct BpfBirthResolver first, point a reader at its onBirth, setLoaded(true) only on a successful start(), advertise the birth-attribution token) is the follow-up PR. Contract documented in AGENTS.md §8b.