feat: expand bounded observation coverage

[kiranmagic7]

Addresses #19. Stacked on #26; merge only after its base branches.

What changed

• adds a versioned rule registry without reusing BL500 or BL600
• observes UDP and port-53 sends, socket/bind/listen/accept, descriptor mutation and enumeration, process lineage, memfd/fileless execution, ptrace, and timing calls
• retains bounded process/parent/descriptor attribution while excluding capture-local IDs from semantic identity
• chronologically merges root-owned per-process traces and handles resumed syscalls, close-on-exec, PID exit, and explicit unknown attribution
• versions the observation policy and requires it for profile comparison
• expands inert hosted fixtures, schemas, documentation, bounds tests, and parser fuzz seeds

Verification

• make check
• go test ./internal/trace -run ^$ -fuzz=FuzzParse -fuzztime=10s (about 495k executions)

No tag, release, image publication, launch action, or live malware execution is included.

[kiranmagic7]

Superseded by the consolidated PR #31. This branch is fully contained in the PR #31 history. Closing it to keep one active upgrade review branch. No merge, release, or launch occurred.