feat(parquet): surface epoll_ctl op/target-fd/events metadata

epoll_ctl's BPF handler already decodes the operation (args[1]),
target descriptor (args[2]), and requested event mask (args[3]->events)
into an EpollCtlEvent, but the single resolved-epfd `fd` column was the
only epoll detail reaching the output schema. Consumers could not see
which descriptor was registered nor the operation performed.

Surface the metadata as three additive, backward-compatible columns,
mirroring the existing dedicated optional-column convention used by
requested_sleep_ns and address_space_bytes:

- epoll_op (String): ADD/MOD/DEL, or the raw decimal for unknown ops;
  empty for non-epoll_ctl rows.
- epoll_target_fd (Int32): registered descriptor (args[2]); 0 otherwise.
- epoll_events (UInt32): requested event mask; 0 otherwise.

Data flows EpollCtlEvent -> event.Pair (new EpollCtl/HasEpoll fields,
populated in handleEpollCtlExit) -> streamrow.Row -> parquet.Record.
The op-to-string mapping lives on event.EpollCtl.OpName.

Docs (docs/parquet-querying.md) and the Magefile parquetValidate column
list updated in lockstep (also adding the previously-undocumented
address_space_bytes/requested_sleep_ns columns). The polling parquet
integration test now asserts epoll_ctl rows carry a decoded op and a
valid target fd, and that other syscalls leave epoll_op empty.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 5 insertions, 2 deletions

diff --git a/Magefile.go b/Magefile.go
index 2a996eb..0396a9e 100644
--- a/Magefile.go
+++ b/Magefile.go
@@ -1164,11 +1164,14 @@ func runClickHouseQuery(dir, file, sql string) (string, error) {
 	return strings.TrimSpace(out), nil
 }
 
-// expectedParquetColumns lists the 15 column names that the parquet schema must contain.
+// expectedParquetColumns lists the column names that the parquet schema must
+// contain. Keep in lockstep with parquet.Record (internal/parquet/schema.go).
 var expectedParquetColumns = []string{
 	"seq", "time_ns", "gap_ns", "latency_ns", "comm",
 	"pid", "tid", "syscall", "family", "fd", "ret",
-	"bytes", "file", "is_error", "filter_epoch",
+	"bytes", "address_space_bytes", "requested_sleep_ns",
+	"file", "is_error", "filter_epoch",
+	"epoll_op", "epoll_target_fd", "epoll_events",
 }
 
 // parquetSchemaCheck verifies that all expectedParquetColumns appear in the