docs: add comprehensive syscall tracing expansion plan

Plan-only document covering the ~230 Linux syscalls ior does not yet
trace. For each not-yet-covered syscall the plan records whether it
takes/returns a file descriptor, whether it has a meaningful bytes or
size dimension that could feed the existing read/write/transfer
accumulators, the suggested TracepointKind (existing or new), extra
per-event metrics, and a priority tier. Also enumerates the taxonomy
extensions required (new TracepointKind values, retClassification
additions, family/dimension tags), risk areas (high-cardinality
syscalls like futex/clock_gettime), and a phased rollout from "free
wins" (network bytes already mapped but blocked by shouldIgnore)
through process lifecycle to the long tail.

No code changes.

0 files changed, 0 insertions, 0 deletions