Add KinD integration tests to CI

- Create GitHub Actions workflow for KinD integration tests
- Fix path normalization for relative paths with .. components
- Fix cgroup selection to skip snoop container itself
- Add unique namespaces per test with async cleanup
- Allow IMAGE_TAG environment variable override in test script

Both alpine-basic and busybox-controlled tests now pass with proper
file capture and path normalization.

Signed-off-by: Jason Hall <jason@chainguard.dev>

pkg/processor/normalize.go

@@ -31,9 +31,9 @@ func NormalizePath(path string, pid uint32, cwd string) string {
 		workDir = getProcessCwd(pid)
 	}
 	if workDir == "" {
-		// Fallback: return cleaned relative path prefixed with /
+		// Fallback: prefix with / and clean the result
 		// This is a best-effort when we can't determine the cwd
-		return "/" + cleanPath(path)
+		return cleanPath("/" + path)
 	}
 
 	// Join with working directory and clean
@@ -56,6 +56,18 @@ func cleanPath(path string) string {
 		cleaned = "/" + cleaned
 	}
 
+	// Handle .. past root: /../foo should become /foo
+	// filepath.Clean preserves this, but we need to strip leading /..
+	// This loop strips all leading /../ sequences
+	for strings.HasPrefix(cleaned, "/../") {
+		cleaned = "/" + cleaned[4:] // Remove "/.." but keep the leading "/"
+	}
+
+	// Special case: if path is exactly "/..", it should become "/"
+	if cleaned == "/.." {
+		cleaned = "/"
+	}
+
 	return cleaned
 }