feat(sight): observe-only BPF LSM audit probe (socket_connect + file_open)

[jfeng18]

What

Adds an opt-in, observe-only BPF LSM probe (lsmaudit) that audits two security-relevant actions for traced Agent families:

• lsm/socket_connect — every outbound connection attempt (destination IP:port), regardless of protocol or port.
• lsm/file_open — every file opened (basename + access mode), deduped per (pid, inode) via an LRU map.

Both hooks filter to traced families via the shared traced_processes map (is_pid_traced) and emit through the shared ring buffer (EVENT_SOURCE_LSM). Events surface as structured audit log lines:

[LSM] connect pid=… comm=… dst=IP:PORT
[LSM] open    pid=… comm=… mode=r|w|rw path=…

Observe-only

Strictly observe-only: every program returns the incoming ret unchanged, so no operation is ever denied. The LSM attach point leaves room for future enforcement.

Opt-in

Off by default. Enable with --enable-lsm-audit (or the matching config field). Requires BPF LSM active (bpf in /sys/kernel/security/lsm); otherwise the probe is skipped with a warning.

Correctness fixes folded in (commit fix(sight): lsmaudit BPF correctness + leak guard)

A self-review of the as-pushed branch caught three issues, all fixed in the latest commit:

1. path[] info leak — bpf_ringbuf_reserve returns a slot that may carry residue from a previously-submitted record on the shared ring buffer (sslsniff TLS plaintext, filewrite content). The original code only zeroed path[0], leaving path[1..256] uninitialized. Memset the whole record after reserve in both hooks.
2. file_open dedup-before-emit — the (pid, inode) LRU was inserted before reserve / read, so any failure permanently suppressed that file. Move the dedup mark to after a successful submit; bpf_ringbuf_discard the slot on path-read failure.
3. socket_connect addrlen unchecked — LSM fires before the protocol-level length check; if addrlen < sizeof(struct sockaddr_in[6]) the destination fields are stack residue. Drop the event in that case.

Plus an always-on Rust-side leak detector: LsmEvent::from_bytes scans path[] past the null terminator and log::warn!s on any non-zero byte — permanent regression net for the producer-side memset invariant.

Testing

Verification	Status	What was checked
已 E2E(real-machine, kernel 6.6.102, BPF LSM active)	✓	Both hooks attach; traced agent's connects/opens captured with correct fields; observe-only proven (all attempts succeed); 173 events on the post-fix sanity run, 0 leak-detector warnings, paths clean.
仅单测(cargo test --lib lsmaudit)	✓	8/8: gate (cacheability), IPv4/IPv6 + port byte-order decode, file_open parsing, RawLsmEvent C↔Rust layout, leak detector positive (garbage tail triggers warn + decoder still cleanly extracts path), leak detector negative (clean tail stays silent). 447 lib tests, zero regressions.
未 E2E(documented gap)	—	The leak class (residue from ringbuf wrap) is not reproducible in a synthetic test in seconds — the 32 MiB ring rarely wraps. A reverse-test with the memset removed produced 158 events and 0 leak warnings on the synthetic load. The fix is correct by construction (defense-in-depth, parallel to filewrite's pattern); the detector exists to catch the real case in long-running production.

Notes

• The event struct is lsm_audit_event to avoid colliding with the kernel's own enum lsm_event in vmlinux.h.
• file_open records the basename only (full path is future work — bpf_d_path is allowlist-rejected for lsm/file_open).
• Other probes likely share the same path-tail-residue pattern (filewrite's buf[16384]). Out of scope for this PR; tracked as a separate follow-up.

Independent of #661–#668.