feat: deepen FromELF into ProbeELF + RequireMinKernel + check --from-elf

[leodido]

Motivation

FromELF only returned what Check(...) consumes (program / map types and helper-per-program requirements). That's enough to gate, but not enough to explain why an object will or won't load on a target kernel: which helpers are superseded, which loads aren't CO-RE-protected, what minimum kernel version the object actually requires.

This PR keeps FromELF frozen against its 4-point contract and adds ProbeELF (and ProbeELFWith(opts...)) as the strict superset, plus a parameterized RequireMinKernel(major, minor) requirement, plus the CLI affordances to drive both.

What this changes

Library

• ProbeELF(path) / ProbeELFWith(path, opts...): returns a richer *ELFProbes snapshot — programs, maps, helper-per-program requirements, derived minimum kernel version, advisory warnings (superseded helpers), and (with WithCOREChecks()) a per-program memory-access classification distinguishing context loads, map-value loads, CO-RE-protected loads, and unprotected kernel-direct loads. Requirements() projects to a FeatureGroup consumable by Check(...).
• RequireMinKernel(major, minor): parameterized requirement gated against uname -r. Composes with the kernel-version snapshot so Probes.Requirements() automatically rejects objects whose helpers, program types, or map types were introduced after the running kernel.
• internal/kernelversions: generated, pure-Go tables of the minimum kernel version that introduced each BPF helper, program type, and map type. Sourced from BCC's kernel-versions.md and Linux UAPI bpf.h at pinned commits via internal/kernelversions/cmd/kvgen. The generator cross-validates UAPI against BCC and refuses to emit a partial snapshot; audited cross-validation gaps live in known_gaps.go with one-line rationales.
• FromELF itself is unchanged — its 4-point contract (cilium parser, parser-only, returns FeatureGroup, deterministic + fail-closed) stays frozen. New extraction surface goes on ProbeELF.

CLI

• kfeatures probe is now a parent command. probe host is the canonical name for the live-kernel probe; bare probe keeps working as an alias by sharing flag state with the host leaf.
• kfeatures probe bpf <path.o> runs the ELF probe on a compiled object. --with-core opts in to CO-RE memory-access classification; --requirements prints only the Check-compatible projection; --json switches both to JSON.
• kfeatures check --from-elf <path.o> accepts an ELF object as a requirement source; --require and --from-elf are now both optional and at-least-one-required.
• MCP tool list: check, config, probe-bpf, probe-host. The bare probe alias is a CLI ergonomic affordance only; agents see the canonical names.

CI

• New .github/workflows/refresh-kernel-versions.yml: weekly cron (Mon 06:00 UTC) plus workflow_dispatch with optional SHA overrides. Resolves upstream HEAD for both repos, bumps the pinned defaults in cmd/kvgen/main.go, regenerates the snapshot, verifies with go vet + kernelversions test package, and opens a dependencies-labelled PR (titled deps(kernelversions): refresh BCC + UAPI snapshot) only when the snapshot drifted.

Coverage gate

• New make cover-check target plus internal/tools/covercheck enforce a per-file coverage threshold (default 90%) on the files listed in the makefile's COVER_FILES variable. The checker honours a single-line // coverage:ignore marker placed in the doc comment of a func declaration or a var foo = func(...) declaration. Wired into CI as a new "Coverage gate" step.
• golang.org/x/tools promoted from indirect to direct because covercheck imports golang.org/x/tools/cover.

Documentation

• README: runnable examples for ProbeELFWith(WithCOREChecks()), RequireMinKernel, the new CLI surface; updated MCP tools list and detection / comparison tables.
• CONTRIBUTING: requirement-items table extended; new sections on the kernel-version snapshot lifecycle and the coverage gate.
• AGENTS: agent-actionable rules for the kernel-version snapshot (don't hand-edit, use the bot, when to grow known_gaps.go) and for the coverage gate.
• CHANGELOG: five new [Unreleased] Added entries.

Stability

• FromELF contract is unchanged (still parser-only, still cross-platform, still returns FeatureGroup, still deterministic + fail-closed).
• ProbeELF is additive — no existing call site of FromELF needs to migrate.
• RequireMinKernel is additive — composes with the existing Requirement model.
• probe CLI alias is preserved byte-for-byte; agents that hard-code probe keep working.
• check: --require is no longer marked flagrequired, and the runtime check now permits --from-elf instead. Old --require=… invocations still work; the missing-flag exit code changes from 10 (structcli missing_required_flag) to 1 (typed no features specified).

Verification

• go vet ./... clean
• go test -race -count=1 ./... 4/4 packages green
• make cover-check all 6 gated files ≥ 90%
• bats test/cli_common.bats test/cli_linux.bats test/cli_mcp.bats 44/44
• CLI smoke (six invocation paths including probe, probe host, probe bpf, check --from-elf, bare check, unknown subcommand) returns the right exit codes and envelopes
• MCP tools/list returns ['check', 'config', 'probe-bpf', 'probe-host']

Commits

11 logical commits, one per spec step. The two CLI commits split cmd/kfeatures/main.go and the bats files between probe-restructuring (#7) and check --from-elf (#8).