fix(memtrack): attach lifecycle and syscall hooks without perf_event_open

[GuillaumeLagrange]

No description provided.

[codspeed]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 17 untouched benchmarks

---

_{Comparing cod-3492-memtrack-classic-tracepoints-cannot-attach-inside-the (af3867e) with main (37eba9e)}

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until older persisted memtrack artifacts containing mapping events can be read without silently truncating their event streams.

Findings

1.  Legacy artifacts truncate silently ▶

Fix with agent prompt

### Issue 1
crates/runner-shared/src/artifacts/memtrack/mod.rs:69
Removing the `Mmap`, `Munmap`, and `Brk` variants breaks reading artifacts produced by earlier memtrack versions. When the stream reaches one of these now-unknown variants, deserialization fails and `.ok()` turns that error into the end of the iterator. The resulting profile silently loses that event and every event after it. Please retain support for these legacy variants or skip them without ending the stream.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR avoids attaching memory-mapping syscall hooks, moves process exec/exit tracking to BTF tracepoints, and removes the unused mmap/munmap/brk event model. It also relaxes a timing-test threshold to account for parent-process preemption.

• Removes mmap, munmap, and brk probes and their event payloads.
• Renumbers the remaining internal eBPF event identifiers.
• Retains lifecycle tracking through fork, exec, and exit hooks.
• Updates memtrack tests and writer benchmarks for the reduced event set.
• Leaves a backward-compatibility problem when reading artifacts containing the removed variants.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    P[Tracked process tree] --> A[Allocator uprobes]
    P --> L[BTF lifecycle hooks]
    P --> R[Optional RSS and rmap hooks]
    A --> B[eBPF ring buffer]
    L --> B
    R --> B
    B --> U[Rust event parser]
    U --> W[MessagePack artifact writer]
    W --> D[Persisted MemtrackArtifact]
    D --> S[Artifact stream reader]

Loading

_{Reviews (2) · Last reviewed commit: "test(exec-harness): allow a 1ms shortfal..."}

[not-matthias]

LGTM