enforcement: (dev, ino) file identity for INODE_ZONE_MAP

[yairfalse]

Inode-only keying collides across filesystems (documented Known Limit). Key by (dev, ino), resolve s_dev via BTF offsets, update self-tests, ingest, and the three file-path hooks (file_open, bprm_check_security, mmap_file).

Part of the v0.4 roadmap.

🤖 Generated with Claude Code