feat: node role — on-node Go buildinfo scanner with zero RBAC (ADR 0009)

[kfeofantov]

What

Adds the agent's second role: agent node, a DaemonSet that scans on-node
Go binaries via debug/buildinfo. One binary, two roles — the controller
remains the default, so existing invocations are unchanged (ADR 0009).

The scanner

• Enumerates /proc, reads debug/buildinfo from /proc/<pid>/exe: Go
  version, main module, dependencies, build settings (incl. -pgo).
• Ties each process to its pod/container by parsing /proc/<pid>/cgroup
  (pod UID + container ID; cgroupfs and systemd driver shapes).
• Filter early on the node: infra module paths (k8s.io/, containerd,
  coredns, etcd, prometheus, grafana, …) and our own github.com/RebuildStackCo/
  are dropped before any record is formed. Only four aggregate counters leave
  for the not-kept classes — scanned / go-found / filtered-infra / unreadable.
  Identities of filtered/unreadable processes never leave (invariant 6).

Security posture (the point of the node role)

• Zero RBAC. The node ServiceAccount is bound to nothing; no Role/Binding
  exists for it and automountServiceAccountToken: false. It holds no
  Kubernetes client and never calls the API.
• hostPID + CAP_SYS_PTRACE only — no CAP_BPF/CAP_PERFMON. The ptrace
  capability is required to read other containers' non-dumpable
  /proc/<pid>/exe (verified in kind); this resolves the CAP_SYS_PTRACE
  "TBD" in security.md §7.
• Read-only root filesystem, seccomp RuntimeDefault, all other caps dropped,
  privileged: false, allowPrivilegeEscalation: false.

Infra & e2e

• Agent Dockerfile; image / kind-load / node-e2e make targets.
• Raw deploy/node-daemonset.yaml (no Helm chart yet, by design).
• Sample Go workload (test/e2e/sample/, its own module path).
• e2e deploys the DaemonSet from the shipped manifest into kind and asserts the
  known Go process is detected with the right version + module path, and infra
  is filtered. Passing locally:
  go_found:4, filtered_infra:20 with example.com/rebuildstack-e2e/goworkload
  detected at go1.26.1.

Docs

• ADR 0009 (node role, hostPID rationale, zero RBAC, what is read from /proc,
  filter policy).
• security.md §3/§4/§7/§8/§9 updated.

Scope

This slice writes findings to the node role's structured log; delivery to the
controller is a later slice. The one-way boundary is unchanged.

Testing

• go build ./..., go test -race ./..., golangci-lint run (default + e2e tag): green.
• Full e2e suite on kind: green; node e2e (make node-e2e): green.

🤖 Generated with Claude Code