ebpf: defer batch API probe for batch lookup

[arunsingh]

Fixes #2013.

BatchLookup() and BatchLookupAndDelete() previously called haveBatchAPI() before attempting the actual batch lookup syscall. The feature probe creates a temporary map, which can require CAP_BPF, so a process that only needs to read from an already-open map could fail before trying the operation that would otherwise succeed.

This defers the batch API feature probe until after a non-ENOENT lookup syscall failure, matching the existing BatchUpdate() and BatchDelete() behavior. The normal end-of-iteration ENOENT path remains unchanged.

The regression test creates maps while privileged, drops all effective capabilities, then verifies batch lookup, update, and delete through the existing map FDs.

Tested:

• go test -exec sudo -run '^(TestHaveBatchAPI|TestMapBatch|TestMapBatchUnprivileged|TestMapBatchCursorReuse)$' .
• git diff --check -- map.go map_test.go

[arunsingh]

Ready for review. I kept the change limited to BatchLookup/BatchLookupAndDelete via batchLookupCmd(), with ENOENT behavior unchanged. The focused regression and root package tests pass on a Linux VM; details are in the PR description.

[dylandreimerink]

Thank you! Change seems good to me, just want to change the regression test.