Add ring buffer overflow detection and metrics

Implement comprehensive ring buffer overflow handling:

- Add dropped_events BPF map to track overflow in kernel space
- Create submit_event() helper that checks bpf_ringbuf_output() return
  value and atomically increments drop counter on failure
- Add Drops() method to read drop counter from eBPF map
- Add snoop_events_dropped_total Prometheus metric
- Track drop deltas and log warnings when overflow occurs
- Include drop count in JSON reports

Ring buffer overflows can occur under high load when events are
generated faster than userspace can consume them. This implementation
provides full observability into overflow events without data loss
of the drop count itself.

Signed-off-by: Jason Hall <jason@chainguard.dev>

plan.md

@@ -7,8 +7,9 @@
 Milestone 3 progress:
 - ✅ Prometheus metrics endpoint (`/metrics` on port 9090)
 - ✅ Structured logging with clog
+- ✅ Ring buffer overflow handling and metrics
 
-**Next**: Ring buffer overflow handling and metrics
+**Next**: Memory-bounded deduplication
 
 See [Milestone 3](#milestone-3-production-hardening) for remaining tasks.
 
@@ -362,7 +363,7 @@ Volume mounts:
 **Deliverables**:
 - [x] Prometheus metrics endpoint
 - [x] Structured logging with levels (clog)
-- [ ] Ring buffer overflow handling and metrics
+- [x] Ring buffer overflow handling and metrics
 - [ ] Memory-bounded deduplication (LRU or bloom filter for extreme cases)
 - [ ] Health check endpoint
 - [ ] Configuration validation