feat: inner-map prototype fixup + KubeArmor behavior lane reference

[ErenAri]

What

Two related changes:

1. Generic inner-map prototype map fixup so bpfcompat can faithfully load objects with map-in-maps (BPF_MAP_TYPE_HASH_OF_MAPS / ARRAY_OF_MAPS) whose inner map the artifact's own loader installs at runtime.
2. A reference behavior lane (examples/oss/kubearmor-system-monitor/) that uses (1) and demonstrates the opt-in, non-blocking behavior validation mode on a real third-party object.

1. Inner-map fixup

New manifest field:

maps:
  - name: kubearmor_visibility
    inner_map: { type: hash, key_size: 4, value_size: 4, max_entries: 64 }

Types: hash, array, lru_hash, percpu_hash, percpu_array, lru_percpu_hash.

Why: a generic libbpf load can't create a HASH_OF_MAPS/ARRAY_OF_MAPS without an inner-map fd — it fails with EINVAL on every kernel (including the newest with BTF), which is a loader contract, not a compatibility result. The existing fixup only supported an inner ringbuf (Falco modern_bpf's ringbuf_maps); this generalizes it.

How: threaded through internal/manifest (InnerMapSpec + validation), internal/runner (tuning + applied-note + JSON parse), internal/vm/qemu.go (--set-map-inner-map <map>=<type>:<key>:<value>:<entries>), and validator/c-libbpf/src/main.c (bpf_map_create + bpf_map__set_inner_map_fd before load). Tests for manifest validation and CLI construction.

2. Behavior lane reference

examples/oss/kubearmor-system-monitor/ validates KubeArmor's system_monitor.bpf.o as shipped (object not vendored — built from KubeArmor per UPSTREAM.md). It declares the inner-map contract above, then runs a behavior-mode functional test that exercises the syscalls system_monitor hooks (execve/openat/close/unlink/uid) under the live monitor and asserts each returned the correct result. required: false keeps it non-blocking. README documents the honest scope: this proves load + attach + liveness/correctness, not event capture (Phase 2, which needs KubeArmor's perf reader).

Verification

Built KubeArmor's system_monitor.bpf.o from source and ran the VM matrix. As-is it failed all kernels at kubearmor_visibility map-create (EINVAL); with the inner-map manifest it loads everywhere, and in behavior mode load + functional pass on all five:

Kernel	Host kernel	Load	Attach	Functional
Ubuntu 20.04 (5.4)	5.4.0-216	pass	52/55	pass
Ubuntu 22.04 (5.15)	5.15.0-181	pass	52/55	pass
Debian 12 (6.1)	6.1.0-49	pass	52/55	pass
Ubuntu 24.04 (6.8)	6.8.0-117	pass	52/55	pass
AlmaLinux 8 (4.18)	4.18.0-553	pass	52/55	pass

go test ./..., go vet, and gofmt all clean.

🤖 Generated with Claude Code