test(fallocate): lock in FS family, KindFd enter, UNCLASSIFIED ret

Audit of fallocate(2) found the tracing correct and consistent with its
fd-based siblings, so add lock-in tests rather than fixing anything:

- fallocate(int fd, int mode, off_t offset, off_t len) returns int 0/-1
  (a status code, NOT a transferred byte count). Its exit must stay a
  plain ret_event with ret_type UNCLASSIFIED so it is never mistaken for
  a READ/WRITE/TRANSFER byte count.
- The enter tracepoint carries a leading fd field (args[0]); only fd is
  captured into a fd_event (KindFd), matching fadvise64/ftruncate/
  sync_file_range which likewise drop their trailing offset/len/advice
  args.
- fallocate belongs to FamilyFS alongside fadvise64/ftruncate/
  sync_file_range.

TestClassifyFallocateEnterFd and TestClassifyExitFallocateUnclassifiedRet
assert the per-syscall behavior; TestClassifySyscallFamily now also
covers fallocate/fadvise64/ftruncate so a stray reclassification trips a
test. No classification logic or generated artifacts changed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions