Process-scoped runtime investigator using eBPF to trace process lifecycle, file activity, and network connections.