M6: Seccomp profile auto-generation from observed behavior

[CodeBuildder]

Goal

Observe pod syscall usage for 24h, generate a minimal seccomp profile, apply it, block everything else.

Tasks

• Deploy seccomp-operator or use Tetragon to record syscalls per pod
• Build profile generator: aggregate syscalls over 24h window per pod/container
• Generate seccomp JSON profiles
• Apply profiles via pod annotations
• Build Argus endpoint: GET /seccomp/profiles, POST /seccomp/apply/:pod

Acceptance criteria

• Profile generated for payment-service in staging
• Profile blocks unexpected syscalls
• Argus UI shows profile coverage per pod