Add bounded syscall lifecycle inventory

[itdevwu]

Goal

Let an agent identify kernel-facing latency without guessing a syscall or retaining every raw event.

Acceptance criteria

• A PID-filtered eBPF path aggregates syscall count and completed entry-to-exit duration before userspace record reservation.
• The table is preallocated and bounded; unsupported syscall numbers, unfinished calls, table saturation, drops, and scalar read failures are explicit.
• Results report count, total/min/max/mean duration and selector hints for named syscalls.
• Aggregation keys include the process/thread lifecycle data required to avoid pairing unrelated calls.
• No pointer argument is dereferenced or copied.
• A high-rate fixture demonstrates lower CPU, memory, and artifact cost than broad raw syscall collection.