[Flaky Test] github.com/elastic/beats/v7/auditbeat/module/auditd TestImmutable

## Flaky Test

* **Test Name:** TestImmutable
* **Scope:** github.com/elastic/beats/v7/auditbeat/module/auditd
* **File:** N/A
* **Location:** N/A
* **Buildkite Link:** https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/0c139a3b-00e8-8f38-8aee-13484410e67f
* **Flaky Instances:** 1
* **Latest Occurrence:** 2026-04-17T03:45:58.475Z

### Details

```json
{
"id": "0c139a3b-00e8-8f38-8aee-13484410e67f",
"web_url": "https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/0c139a3b-00e8-8f38-8aee-13484410e67f",
"scope": "github.com/elastic/beats/v7/auditbeat/module/auditd",
"name": "TestImmutable",
"location": null,
"file_name": null,
"instances": 1,
"latest_occurrence_at": "2026-04-17T03:45:58.475Z",
"most_recent_instance_at": "2026-04-17T03:45:58.475Z",
"last_resolved_at": null,
"ownership_team_ids": [],
"failure_examples": []
}
```

Start with TestImmutable in the github.com/elastic/beats/v7/auditbeat/module/auditd scope and review its Buildkite analytics entry for the reported flaky run. Reproduce the test and inspect its failures; done means TestImmutable runs reliably without intermittent failures in the relevant test suite.

Written by the indexing model from the issue text.