probes: BPF uprobe service for entry/exit duration tracking via OTLP logs

[gnurizen]

Summary

Adds a generic eBPF uprobe service that attaches paired entry/exit probes to declared symbols and emits per-call duration records through the OTLP logs pipeline introduced in #3190.

The motivating use case is finding long JS execution blocks in Node.js applications. A 200 ms callback hogging the libuv event loop is exactly the "phantom" tail latency that doesn't show up in CPU profiles. The reference config attaches to node::InternalCallbackScope's ctor + dtor, brackets each outer libuv callback, and emits one record per scope close with a precise duration measured in BPF.

What's added

• probes/ package:
  • YAML config schema: {id, file_match (regex), entry_symbol, exit_symbol, main_thread_only, min_duration_ms}.
  • eBPF uprobe program (paired entry + exit) with a per-tid scope counter that emits only when the outer scope closes. Nested scopes roll into the outer's measured duration. Main-thread filter via tid == tgid directly in BPF; libuv worker-pool / V8 background threads are silently dropped.
  • User-space drains the BPF ringbuf and emits one OTel log.Record per completed outer scope via Logger("parca-agent.probes"), so consumers can filter on attributes_scope.name to slice probe records vs other agent logs.
• --probe-config <path> CLI flag (default: disabled). Requires a remote-store.
• Reference probes/testdata/probes.yaml.sample with the Node.js InternalCallbackScope ctor + dtor pair pre-verified on Node v18.20 / v22.17 / v24.4 (same mangled symbol on all three, exported via .dynsym so stripped builds work too).
• Build system: single arch-agnostic probe.bpf.o (no PT_REGS_* macros used). Makefile + .goreleaser.yml before: hook + CI workflow + probes/bpf/README.md set up to produce it on every release.

Data on the wire

Each probe-fire record:

Field	Value
body	"node.callback_scope" (stable; queryable)
timestamp	exit ktime → unix ns via shared times.KTime offset (aligned with CPU sample timestamps; range queries over [start_ns, end_ns] against the profile-samples table don't drift)
attributes	start_ns, end_ns, duration_ns, pid, tid, comm, is_main, spec_id, probe_id, level
resource	inherited from the OTel SDK LoggerProvider: service.name, service.version, host.name
scope	"parca-agent.probes"

Test plan

• make probes-bpf produces probes/bpf/probe.bpf.o
• go build ./... clean
• go test ./probes/... ./reporter/... -count=1 — all pass
• Local end-to-end on linux/amd64 against PolarSignals backend: ran node blocker.js doing synthetic 200 ms blocks. Agent attached, fired 142 times over 8 seconds. Duration histogram: 112 sub-ms callbacks (libuv noise), 27 records at 199 ms and 3 at 200 ms (the blocker). Exactly the expected signal.
• Reviewer: verify on an arm64 build. BPF bytecode is arch-agnostic but exercising the cross-compile pipeline this PR sets up is worthwhile.

Stacked on

Was stacked on #3190 (OTel logs support), which has since merged. This branch is now rebased directly on top of main.