fix(family): reclassify get_mempolicy as Memory not Security

get_mempolicy(2) retrieves the NUMA memory policy for a thread or
address range and is logically a Memory-family syscall, sharing
FamilyMemory with its NUMA siblings set_mempolicy, set_mempolicy_home_node,
mbind, migrate_pages, and move_pages. It was misclassified FamilySecurity
(a copy/paste/alphabetical-ordering slip alongside the security modules).

Move it to the Memory group in internal/generate/family.go, update the
Memory and Security lists in docs/syscall-tracing-plan.md (keeps the
docs_drift_test green), and regenerate artifacts (traceId2Family 735/734
and syscallFamilies[get_mempolicy] flip Security->Memory; C unchanged,
mage generate idempotent). Add enter+exit family lock-in assertions for
get_mempolicy and set_mempolicy alongside the NUMA siblings so the whole
cluster is pinned.

Task 120.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2 files changed, 13 insertions, 6 deletions

diff --git a/internal/generate/family.go b/internal/generate/family.go
index a3c242f..71ce724 100644
--- a/internal/generate/family.go
+++ b/internal/generate/family.go
@@ -52,7 +52,8 @@ var syscallFamilies = map[string]SyscallFamily{
 	"futex": FamilyIPC, "futex_wait": FamilyIPC, "futex_wake": FamilyIPC,
 	"futex_requeue": FamilyIPC, "futex_waitv": FamilyIPC,
 
-	"brk": FamilyMemory, "madvise": FamilyMemory, "map_shadow_stack": FamilyMemory,
+	"brk": FamilyMemory, "get_mempolicy": FamilyMemory, "madvise": FamilyMemory,
+	"map_shadow_stack": FamilyMemory,
 	"mbind": FamilyMemory, "membarrier": FamilyMemory, "migrate_pages": FamilyMemory,
 	"mincore": FamilyMemory, "mlock": FamilyMemory, "mlock2": FamilyMemory,
 	"mlockall": FamilyMemory, "mmap": FamilyMemory, "mmap2": FamilyMemory,
@@ -125,7 +126,7 @@ var syscallFamilies = map[string]SyscallFamily{
 
 	"add_key": FamilySecurity, "bpf": FamilySecurity, "capget": FamilySecurity,
 	"capset": FamilySecurity, "delete_module": FamilySecurity, "finit_module": FamilySecurity,
-	"get_mempolicy": FamilySecurity, "getrandom": FamilySecurity, "init_module": FamilySecurity,
+	"getrandom": FamilySecurity, "init_module": FamilySecurity,
 	"kexec_file_load": FamilySecurity, "keyctl": FamilySecurity,
 	"landlock_add_rule": FamilySecurity, "landlock_create_ruleset": FamilySecurity,
 	"landlock_restrict_self": FamilySecurity, "lookup_dcookie": FamilySecurity,
diff --git a/internal/generate/family_test.go b/internal/generate/family_test.go
index ba851c2..50c8120 100644
--- a/internal/generate/family_test.go
+++ b/internal/generate/family_test.go
@@ -23,13 +23,19 @@ func TestClassifySyscallFamily(t *testing.T) {
 		// memory range (start,len,home_node,flags); it returns 0/-1 with no byte
 		// count, so it is KindNull and Unclassified. It is a NUMA memory-policy
 		// syscall and shares FamilyMemory with its siblings set_mempolicy(2),
-		// mbind(2), migrate_pages(2), and move_pages(2). NOTE: get_mempolicy(2) is
-		// the one NUMA sibling currently classified FamilySecurity instead of
-		// FamilyMemory — that inconsistency is tracked separately and is out of
-		// scope for this set_mempolicy_home_node assertion.
+		// get_mempolicy(2), mbind(2), migrate_pages(2), and move_pages(2). Pin the
+		// whole NUMA memory-policy cluster (enter+exit) so a stray reclassification
+		// of any one syscall trips this test. In particular get_mempolicy(2)
+		// retrieves the NUMA policy of a thread/address (not a security operation)
+		// and was previously misclassified FamilySecurity; assert it here so the
+		// group stays consistent. Keep in sync with the Memory list in
+		// docs/syscall-tracing-plan.md.
 		{"sys_enter_set_mempolicy_home_node", FamilyMemory},
 		{"sys_exit_set_mempolicy_home_node", FamilyMemory},
 		{"sys_enter_set_mempolicy", FamilyMemory},
+		{"sys_exit_set_mempolicy", FamilyMemory},
+		{"sys_enter_get_mempolicy", FamilyMemory},
+		{"sys_exit_get_mempolicy", FamilyMemory},
 		{"sys_enter_mbind", FamilyMemory},
 		{"sys_enter_migrate_pages", FamilyMemory},
 		{"sys_enter_move_pages", FamilyMemory},