[T6-1] eBPF agent-class-filter.c — kernel-level five-class enforcement

[mdheller]

Deferred-runtime (needs Linux kernel + clang-bpf). eBPF program on tracepoint/syscalls/sys_enter_execve: binary path → bundle registry → classify against the five-class ontology (sourceos-spec T0-1 / ontogenesis T1); log NDJSON to $LEDGER_PATH; anySource → WARN + anomaly counter. Contract already landed: the 13-seam registry (SociOS-Linux/workstation-contracts contracts/seam-registry.json). Spec captured at ~/dev/spec-intake/2026-07-31/ (register: docs/spec-intake on sourceos-spec branch capture/spec-intake-register-2026-07-31). Part of the Agentic-Stack / Tranche program (epic SocioProphet/socioprophet#490).