feat(build): Gate the Linux port with full CI and document its runtime contract

[mostafa]

Rounds out the Linux build and CI so the backend is gated the way the Windows one is, and documents what a host has to provide to run it.

Build targets

Target	Purpose
build	Pins GOOS/GOARCH and builds from the committed objects, so a checkout needs no clang
ebpf-drift	Regenerates and fails if the result differs from what is committed
check-clang	Refuses to generate with the wrong clang major
test-race, test-integration, lint	The remaining gates, runnable locally

check-clang exists because clang records its version in BTF. Generating with a different major rewrites every object and fails the drift check with a diff that reads like a source change rather than a toolchain mismatch, which is a confusing half hour the first time it happens.

CI

The Linux workflow now runs build, generation drift, lint, unit tests, race tests, rule validation, a prerequisite probe, and the privileged integration suite.

Two steps are ordered deliberately. The build runs before clang is installed, so it fails the moment something starts depending on generation tools at build time instead of the committed objects. And the prerequisite probe is its own step rather than being implied by the integration tests: without it, a runner that silently loses runtime BTF or drops below the 5.9 floor produces a suite where every test fails identically, for a reason buried in a wrapped error several frames down. TestPrerequisitesAreMet runs the same gate Open does, so the architecture check is covered too, and it fails rather than skipping.

clang is pinned to the major the committed objects were generated with, for the reason above.

Lint scope

Lint is blocking, but covers internal/ebpf, internal/bootstrap, pkg/filter, and pkg/rules rather than everything that builds on Linux. Widening it brings back 41 findings in shared code, nearly all unused reports for helpers that only Windows reaches, and there is nothing to fix from this side without moving Windows code around.

Getting that scope to zero did turn up real dead code, which is the first commit. containsEventTypes and containsFieldMatch are only ever called from compiler_windows.go, and isNumber only validates Windows field arguments, so all three moved next to their callers. The Linux framePID and threadpool accessor stubs had no callers at all and are gone. The event.PID(...) conversions around MustGetPid were no-ops on both platforms, since PID is a type alias for exactly what the accessor returns.

go vet is not a separate target: govet already runs inside golangci-lint on the same scope, and running it wider trips pre-existing MarshalJSON() []byte signature findings in shared marshalling code that are out of scope here.

Docs

docs/setup/linux.md covers the hard prerequisites and why there is no BTF fallback, the capability set, how to read the startup probe, which attachment warnings are expected, best-effort procfs enrichment, and the ebpf.* metrics.

Two additions worth flagging. CAP_KILL is listed because the kill action needs it against processes Fibratus does not own. And the page calls out the two situations capabilities cannot fix, kernel lockdown in confidentiality mode and pre-5.11 RLIMIT_MEMLOCK accounting, because both surface as permission errors that look exactly like a missing capability.

Verification

build-linux from committed objects with no clang present, make test across 8 packages, make test-race, make ebpf-drift clean, lint clean on the gated scope, and GOOS=windows go build ./... unaffected. The prerequisite probe was exercised in both directions: failing loudly with linux eBPF capture requires amd64 on arm64, and passing with the full probe line on a capable host.