feat(nodeagent): collect container system calls

[jianpingpei]

Summary

• Add an opt-in syscalls Source that attaches an eBPF program to raw_syscalls/sys_enter, resolves sandbox container cgroups, and emits ordered NDJSON records through the existing Node Agent pipeline to file or OSS sinks.
• Extend the sandbox store with the full container runtime ID and restart count required to bind events to the correct container incarnation.
• Add Helm configuration that grants BPF and PERFMON capabilities and read-only cgroup v2/tracefs mounts only when the Source is enabled.
• Keep the first-stage coverage contract explicit: no eBPF WAL is provided, attachment starts after the container ID is observed, delegated descendant cgroups are not covered, and finalization markers remain incomplete with the corresponding loss reason.
• Add deterministic BPF generation/verification, focused unit tests, chart documentation, and CI coverage.

Testing

• Not run (explain why)
• Unit tests
  • cd components/nodeagent && make check
  • Linux amd64: go test ./pkg/source/syscalls
  • Windows amd64 build and compile-only test execution
• Integration tests
  • Helm lint and default/syscalls/null-security-context render assertions
  • Ubuntu 24.04 amd64, clang 18: make verify-syscalls-bpf
• e2e / manual verification
  • Real Kind file-sink run captured 1,024 syscall records, including comm: "sh".
  • The ordinary sandbox produced NDJSON and an incomplete revision-1 marker with syscall-attach-after-container-start.
  • The Pool Pod produced no syscall output.

Breaking Changes

• None
• Yes (describe impact and migration path)

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed)
• Added/updated tests (if needed)
• Security impact considered
• Backward compatibility considered

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1b89d4e923

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".