Add mprotect syscall events

[Aegrah]

Summary

Collect successful executable-memory mprotect() calls as an eBPF-only Quark event.

sys_enter_mprotect records address, length, and protection when PROT_EXEC is requested. sys_exit_mprotect correlates the call, deletes its state, and emits only when the syscall succeeded. Emitted masks are X, RX, WX, and RWX; non-executable masks and failed calls are suppressed. No kprobe fallback is added.

Issue: https://github.com/elastic/endpoint-dev/issues/20408

Workflow and proof

The contract workflow built and tested Quark, regenerated package/schema outputs, built Endpoint, ran focused unit/EAF tests, deployed through Fleet, and asserted Elasticsearch output.

• Preflight 20260722T124741Z-mprotect-preflight: PASS
• Fleet acceptance 20260722T142745Z-mprotect on Stack/Agent/Endpoint 9.4.2: PASS
• Elasticsearch semantic assertion: four X/RX/WX/RWX documents checked
• Realistic workstation qualification 20260722T103000Z-mprotect-realistic-smoke: PASS

3,708 Endpoint documents / 4,737 action values
exec: 523 (11.04%); mprotect: 6 (0.13%, 0.16% document coverage)
mprotect executables: /usr/bin/node 5; chromium headless_shell 1
masks: RWX 6 (100%)

Companion PR

• endpoint-package: [WIP] Add fields for Linux mprotect events endpoint-package#767

[haesbaert]

heya, sorry for the delay, I'm trying to priorize things that are blocking others before my final date, I assume this is not WIP anymore as the title suggests?

[Aegrah]

Correct @haesbaert. We are passing unit tests now and should be g2g for an initial review! Removed the WIP from the title. Please be thorough on this one; any feedback I can use to improve anything pushed in the future.