v0.4: implement node-owned eBPF link lifecycle and capability status

Parent epic: #6
Depends on the CNI handoff proof.

Implement the prepared-node agent ownership core:

- executable capability probe and stable node observation;
- UID/generation-owned cgroup programs, maps, links, and pins;
- adoption after loader/agent restart;
- atomic deny-to-deny update and failed-update retention;
- severed-link detection, Pod deletion/quarantine checks, and bounded GC;
- node reboot recovery before preview workloads resume;
- least-privilege amd64/arm64 security profiles, including a narrow Raspberry Pi AppArmor profile.

No prefix/glob cleanup, alphabetical identity, silent detach, or backend fallback. Acceptance is packet/lifecycle evidence, not feature presence.