feat(sight): blood lineage tree with AGENT_MODE detection

[jfeng18]

What

Adds the blood lineage tree for AI agent process tracking — a userspace mirror of process parent-child relationships, enriched with type classification (Agent / SubAgent / Tool, with Skill forward-declared for a follow-up scoring task).

The classifier is built from two complementary signals already produced by AgentSight:

• proctrace exec/exit events feed the tree's parent-child links.
• procmon + /proc/[pid]/environ detect the AGENT_MODE=1 environment variable that marks a top-level Agent root.

Update (audit fixes folded in, commit fix(sight): lineage correctness + AGENT_MODE gate)

A self-review of the as-pushed branch caught five issues:

1. PID-reuse phantom child in LineageTree::insert — re-parenting did not detach the pid from the old parent's children list (PID reuse where the old Exit was missed). Detach-then-attach in insert.
2. AGENT_MODE state routed via stringly-typed name prefix — update_lineage_from_proc inferred AGENT_MODE from a "agent-mode-" prefix on the cached agent display name. Replaced with a direct read of the lineage tree node's LINEAGE_FLAG_AGENT_MODE bit (set by procmon's earlier ensure_lineage_node call).
3. AGENT_MODE precedence rule untested — added two discriminating tests pinning that AGENT_MODE on a child of an Agent/SubAgent stays Tool (reordering match arms in classify() would now fail).
4. ProcessType::Skill forward-declared but undocumented — added a doc comment marking it as forward-declared for the follow-up scoring task, plus a test pinning that classify() never produces Skill under any current input.
5. Commit subjects ≤50 chars — the two original commits were 73 and 63 chars; reworded to 49 and 45 during the rebase.

Testing

Verification	Status	What was checked
仅单测 (cargo test --lib lineage)	✓	10/10: insert/remove/parent-link, classify (agent_mode root / tool under agent / subagent), roots, PID-reuse phantom child cleanup (discriminating: without the cleanup, the new test fails — old parent retains stale child entry), AGENT_MODE precedence × 2 (parent=Agent / parent=SubAgent + has_agent_mode_env=true → Tool, never Agent), Skill never produced (cross all parent types and flag combos). 449 lib tests, zero regressions.
未 E2E	—	Long-running production traffic (PID reuse under ringbuf pressure, AGENT_MODE inheritance through deep process chains, full lineage tree growth) not exercised in this PR. The fix paths are unit-test-discriminating, but the in-the-wild conditions that motivate them — drop a proctrace Exit event, then re-exec the same pid under a different parent — were not staged on a real machine.

Independent of #662–#668.

[CLAassistant]

All committers have signed the CLA.

[jfeng18]

This is the base for the lineage + scheduler stack (#661 → #662). 595 lines, 3 commits. Would appreciate a first pass when you have time.