fix: port upstream push-path and container-tracking fixes (B1 of #369)

[mayankpande88]

Summary

First batch of #369: nine commits from upstream coroot-node-agent (v1.29–v1.36), cherry-picked with -x. They make the agent more robust when it pushes data out, and fix how it tracks containers and systemd units.

Upstream commit	Author	Change
coroot/coroot-node-agent@273c780	Nikolay Sivko	Remote-write no longer gets stuck on one spool chunk. The agent discards an empty chunk, and drops a chunk the receiver rejects with 400 or 413 instead of retrying it forever. Spool files are fsynced.
coroot/coroot-node-agent@a5999af	Nikolay Sivko	Remote-write requests carry a Content-Length instead of chunked encoding.
coroot/coroot-node-agent@fa609da	Vishnu Kvs	New --ca-file / CA_FILE: trust a private CA for remote-write, traces, logs and profiles.
coroot/coroot-node-agent@3d898f9	Nikolay Sivko	A mount that leaves a container's mount namespace stops being reported. Before, its series stayed and showed whatever filesystem was now at that path.
coroot/coroot-node-agent@2d90d4a	Nikolay Sivko	--ephemeral-port-range accepts several ranges, and port 50051 (gRPC) is never treated as ephemeral.
coroot/coroot-node-agent@75d6656	Nikolay Sivko	Every pid mapped to a container is registered as one of its processes.
coroot/coroot-node-agent@5b2cb5f	Alexandre Proulx	podruntime.slice is recognised as a systemd slice.
coroot/coroot-node-agent@91fdf8d	Nikolay Sivko	php-fpm application type.
coroot/coroot-node-agent@f76895d	KR Ravindra	Clear error when the kernel lacks kprobe or tracepoint BPF programs (CONFIG_BPF_EVENTS).

coroot/coroot-node-agent@1e261c3 (log each message once) isn't included: #358 already does the same here.

There's one more commit of our own, 2beb65f, from review. The send loop and the spool truncation both delete spool files. A file one of them deleted after the other had listed it used to make the send loop back off for 5s–1m, or make truncation fail and drop the payload being spooled. Both now skip a file that is already gone.

Engineering detail

Changes from upstream:

• 3d898f9: upstream rewrites c.mounts in getMounts without taking a lock. In this fork, onFileOpen writes c.mounts under c.lock from the event goroutine, so the unchanged commit would cause concurrent map writes. Here the cleanup runs under c.lock, and the statfs loop works on a copy.
• 75d6656:
  • This fork already had ensureProcess (fix(tls): count TLS capture losses and fix the gaps they exposed #353), called on exec, listen and connect events, so the restart case upstream fixed was already handled. What the commit adds here is registration inside getOrCreateContainer for every event type, file opens included.
  • The lookup in ensureProcess now holds c.lock.
  • Process-start events keep calling onProcessStart, because it replaces a process whose pid was reused.
  • Upstream's createdAt fallback belongs to --min-container-age and will come with that flag in the next batch.
• fa609da: this fork sets OTLP TLS options only for https endpoints, so that branch now uses the shared TLS config.
• 2d90d4a: only the flag help text changes; the fork keeps its own flag style.

Behaviour changes:

• A remote-write 400 or 413 now drops that chunk instead of blocking every chunk behind it.
• Connections to port 50051 are always tracked.

CI: gofmt, goimports, vet, golangci-lint, go test (excluding /containers) and the build all pass in a Linux container with Go 1.26.5.

2beb65f: CI checks pass. It covers a timing race, so the local e2e below didn't exercise it.

Squash merge: the commit list and the (cherry picked from commit …) lines carry the upstream attribution.

Local e2e: I built agent binaries from this branch and from main and ran them as systemd services on a local Debian 12 VM (kernel 6.1, systemd 252). They pushed to a local VictoriaMetrics and OpenTelemetry collector behind TLS signed by a private CA.

• Private CA: with CA_FILE, this branch delivered metrics, traces and logs. Main failed with "certificate signed by unknown authority".
• Content-Length: this branch's remote-write requests carried Content-Length; main's were chunked.
• Spool: an empty chunk and a malformed chunk were queued ahead of four real ones. This branch discarded the empty one, dropped the malformed one on 400, and drained the rest. Main retried the malformed chunk with growing backoff while 10 chunks queued behind it.
• Stale mount: after a lazy unmount of a loop-device volume a service was writing to, this branch stopped reporting that path. Main kept reporting it, with the root filesystem's size and usage.
• Port ranges: with EPHEMERAL_PORT_RANGE=1024-23768,30000-65535, this branch skipped connections to :8080 and kept :25000.
• Restart: a systemd unit restarted with a new main PID stayed in both builds' metrics past the 10-minute GC window.
• Logs: neither agent logged an error or a panic.

[gemini-code-assist]

Code Review

This pull request introduces several enhancements and bug fixes to the node agent. Key changes include adding support for podruntime.slice cgroups, allowing multiple port ranges in the ephemeral port filter, updating PHP command regex to support php-fpm, and refactoring container mount tracking to prevent duplicate volume reporting. Additionally, a new --ca-file flag is introduced to support custom CA certificates across telemetry exporters, and the Prometheus remote writer is improved to read spool files into memory (avoiding chunked encoding issues), sync files to disk, and handle rejected payloads. Feedback on the changes highlights two issues: a potential nil pointer dereference in common/api.go if x509.SystemCertPool() returns a nil pool, and a race condition in prom/remote_writer.go where deleted spool files can trigger an unnecessary 5-second backoff delay instead of being skipped immediately.