Add wiki: Home, Installation, Usage, Architecture, BPF Hooks, Roadmap Documents the five eBPF hooks and why each uses tracepoint vs fentry, the kernel->ring buffer->SQLite event flow (including the /proc startup backfill and the WAL/batched-write path), per-subcommand usage and privilege requirements, install and packaging routes, and the honest list of v1 limitations with a roadmap. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L2k9yTHP4UgWs7DVFwz29f