fix: FeatureBPFFS / FeatureTraceFS verify filesystem type

[leodido]

Motivation

The probe behind FeatureBPFFS and FeatureTraceFS used os.Stat + IsDir, returning Supported=true on any host where the directory existed. On modern systemd distros /sys/fs/bpf and /sys/kernel/tracing exist by default whether or not the corresponding pseudo-filesystem is actually mounted, so callers gating on these features (e.g. before bpf_obj_pin) silently got a false positive and failed at I/O time.

A user that does:

if err := kfeatures.Check(kfeatures.FeatureBPFFS); err != nil {
    return err
}
// ... pin maps on /sys/fs/bpf

would pass the check on a typical systemd box where /sys/fs/bpf exists as a directory but bpffs is not mounted, then fail at bpf_obj_pin() with a confusing errno.

Change

Switch the gated checks to Statfs + superblock magic comparison:

• FeatureBPFFS now requires unix.BPF_FS_MAGIC at /sys/fs/bpf.
• FeatureTraceFS now requires unix.TRACEFS_MAGIC at /sys/kernel/tracing or its legacy fallback /sys/kernel/debug/tracing.

Single internal checkMount(path, magic) helper backs both. An injectable package-level statfs function variable lets unit tests exercise every branch (matching magic, mismatch, missing path, syscall errno) without privileged operations.

The diagnostic-only fields SystemFeatures.DebugFS and .SecurityFS keep their previous presence-only semantics — no gated Feature* exists for them today, so directory-presence is sufficient.

Notes

• Pre-1.0 (v0.3.x), the previous behavior was a bug; correct callers see no change. CHANGELOG entry added under [Unreleased].
• Statfs_t.Type is signed on some architectures; comparison casts to uint32.
• This PR is part 1 of 2. A follow-up will add a parameterized RequireMount(path, magic) requirement on top of the same checkMount helper, plus integration tests against a real tmpfs mount in a new CI job.

Verification

• make build && make test green (-race -count=1).
• go vet ./... clean.
• New tests in caps_mount_test.go cover checkMount, probeFilesystemMounted, and probeFilesystemMountedAny against a fake statfs for: matching magic, magic mismatch, missing path, syscall errno wrapping, primary/fallback path selection.