test(collector): table-drive syscall tests

[VaishnavSreekumar]

What

Refactor syscall snapshot tests into a table-driven test structure and add coverage for requested boundary cases.

Why

Fixes #132

How

• Consolidated repetitive syscall snapshot tests into a single table-driven test using t.Run(...)

• Preserved existing aggregation, error-tracking, and empty-snapshot coverage

• Added coverage for:

  • single event
  • exactly-threshold (MaxSyscallEntriesPerSnapshot)
  • top-N ranking boundary (MaxSyscallEntriesPerSnapshot + 1)

• Kept TestSyscallCollectorCapEnforced and TestSyscallCollectorEntriesCapped unchanged

• Each subtest creates its own collector instance

• No t.Parallel() usage

Testing

• go build ./... passes

• go test ./... passes

• go vet ./... passes

• golangci-lint run ./... passes

• Tested locally with:

  • go test ./internal/collector -run Syscall -v
  • go test ./...

• N/A — pure docs/refactor

• sudo ./bin/bpf-verify --read 5s confirms 6/6 programs still load

• ./scripts/verify.sh passes (or specific phase: ./scripts/verify.sh quality)

Checklist

• PR title follows Conventional Commits (test(collector): table-drive syscall tests)
• All commits are DCO-signed (git commit -s)
• No unrelated changes pulled in
• Documentation updated where user-visible behavior changed
• Added/updated tests for new code paths
• If a new doctor rule, paired with a chaos scenario in scripts/verify.sh

[github-actions]

🚀 First PR — welcome aboard!

A few things to expect:

1. CI: every PR runs build + race tests + lint + (eventually) the kernel matrix. If something fails, the log will tell you exactly which gate.
2. DCO: every commit needs Signed-off-by: — git commit -s adds it automatically.
3. Conventional Commits: PR titles like feat(doctor): add new rule or fix(bpf): handle X. We squash-merge by default.
4. Review: a maintainer will review within 72 hours. Suggestions are conversations, not orders — push back if something doesn't fit your context.

If you get stuck, reply here or jump to Discussions. We want this PR to land.