feat: add verified compatibility preview

[ErenAri]

Summary

Introduces a certification-like Verified Compatibility Preview, initially scoped to the exact Falco scap-open binary and its real modern_bpf loader path.

• adds a versioned falco-modern-bpf-v0.1 conformance profile and canonical five-kernel matrix
• adds bpfcompat conformance evaluate with explicit conformant, nonconformant, and inconclusive decisions
• emits in-toto Test Result evidence for every valid evaluation and a Simple Verification Result only for conformant evaluations
• binds evidence to the exact subject SHA-256, profile digest, report digest, kernel/image evidence, verifier identity, and run URL
• extends the weekly Falco external-consumer canary to attest standard predicates with GitHub OIDC/Sigstore
• documents the trust model, verification workflow, limitations, and promotion criteria

Why

BPFCompat should make narrow compatibility claims that consumers can verify, not broad self-declared certification claims. This preview proves the model against Falco while retaining explicit scope and failure semantics.

Impact and merge timing

Draft: do not merge before v0.4.0 production graduation. This adds supported CLI and workflow behavior, so merging it during the active four-week evidence window could require a new release candidate and restart the campaign. It is staged as post-v0.4/v0.5 work.

This does not claim Falco or CNCF endorsement and does not certify the full Falco daemon or rules engine.

Validation

• go test ./...
• go test -race ./...
• go vet ./...
• golangci-lint run --timeout=5m --new-from-rev=origin/main
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.11
• git diff --check
• real Falco scap-open --modern_bpf --num_events 10 dress rehearsal passed all five required KVM profiles and all eight profile assertions

Tracks the post-v0.4 direction described in the existing graduation record; no new tracking issue is required.