AD-007 — Pure-Go eBPF loader, kernel ≥ 5.10

Decision: Load/attach eBPF in pure Go via cilium/ebpf + bpf2go (no CGO); target kernel ≥ 5.10 (BTF/CO-RE); sidecar caps CAP_BPF + CAP_NET_ADMIN + CAP_PERFMON.
Reason: Pure-Go loader keeps the build CGO-free; CO-RE lets one object run across kernels; those caps are the least-privilege set for cgroup + uprobe attach on ≥ 5.8.
Trade-off: Excludes kernels < 5.10 and rootless Podman (these program types need rootful).
Scope: Whole project.
Date: 2026-09-09
Status: active — cap list amended: CAP_PERFMON dropped by AD-010 (it was uprobe-attach-only); CAP_SYS_RESOURCE (AD-009) and CAP_NET_RAW (AF_PACKET capture) added. Live set: CAP_BPF+CAP_NET_ADMIN+CAP_SYS_RESOURCE+CAP_NET_RAW after --cap-drop ALL.