ci: non-blocking build-on-target eBPF kernel-compatibility lane (system_monitor)

[ErenAri]

This is the small, non-blocking proof-of-concept lane I offered in #2683.

It answers one narrow question on a schedule: does system_monitor.bpf.o still
build and load across a set of real vendor distro kernels? For each kernel it
boots a disposable VM, installs the toolchain, builds system_monitor.bpf.o
against that kernel's own BTF (matching KubeArmor's per-node build model -
the BPF Makefile builds with CO-RE access-index preservation off), then loads it
with the kubearmor_visibility HASH_OF_MAPS inner map installed as the loader
would, and produces a classified JSON/Markdown report.

Green run on GitHub-hosted runners (my fork), all four kernels:
https://github.com/ErenAri/KubeArmor/actions/runs/30216558482

• almalinux-8 (4.18, RHEL-family backport)
• ubuntu-22.04 (5.15)
• debian-12 (6.1)
• ubuntu-24.04 (6.8)

Scope and honesty, following our discussion in #2683:

• Complementary to lvh, not a replacement. lvh provisions kernels for full
  KubeArmor functional/E2E tests; this narrowly checks that the BPF object still
  builds+loads on vendor kernels and classifies why if it doesn't.
• Non-blocking: schedule + workflow_dispatch only, no PR/push trigger.
• Loader caveat: the load uses bpfcompat's libbpf-based validator, whereas
  KubeArmor's runtime loader is cilium/ebpf. A libbpf load-pass is a strong
  signal but not identical. A natural follow-up is to swap in a small
  KubeArmor-owned cilium/ebpf self-test via the same command mode (verdict =
  exit code), which would exercise the real loader path.
• Ubuntu 20.04 (5.4) is intentionally omitted: focal's bundled bpftool
  predates raw-BTF dump, so bpftool btf dump file /sys/kernel/btf/vmlinux format c fails there - KubeArmor's own build hits the same on focal.

Disclosure: I maintain bpfcompat. Happy to adjust the kernel set or cadence,
rework it as the cilium/ebpf self-test variant, or drop it - whatever is most
useful. No obligation either way.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[ErenAri]

hello can you look at it @parisnakitakejser @legorie @asharma0703 @asifalix