Toolbox: PVE9 apparmor via lxc.conf, runtime tracefs/debugfs mounts (#826)

- PVE 9 dropped 'pct set --raw.lxc': lxc.apparmor.profile goes straight
  into /etc/pve/lxc/<vmid>.conf and PVE::LXC honors it over the generated
  profile (verified: /proc/self/attr/current = unconfined)
- pct skips virtual-fs bind sources (mp /proc,/sys/kernel/* landed empty):
  keep cgroupfs + /var/log binds, wrapper mounts tracefs/debugfs at start
- bpftrace PROVEN against host kernel (2689 tracepoints, live syscall
  counts showing host pvestatd/vgs); bcc-tools -> bpfcc-tools (bookworm)
- smartctl on SAT devices needs -d sat (recipes updated)

Redmine: https://projects.knownelement.com/issues/826

monitoring/README.md

@@ -39,17 +39,19 @@ installer (`monitoring/node-install.sh`) is idempotent — safe to re-run.
 ## The toolbox container (vmid 950, `knelperf-toolbox`)
 
 PVE-native LXC on each node — Debian 12, privileged, apparmor
-unconfined, bind mounts for host `/proc`, `/sys/fs/cgroup`, debugfs,
-tracingfs, `/var/log` (ro) and up to 8 block devices. **Stopped at
-rest; `onboot=0`.** Tools: bpftrace, BCC, sysstat, iotop, sysbench,
-fio, iperf3, stress-ng, perf, smartmontools, nvme-cli, hwloc…
+unconfined, bind mounts for host cgroupfs and `/var/log` (ro), up to 8
+block devices, and runtime-mounted tracefs/debugfs (pct skips
+virtual-fs bind sources — the wrapper mounts them on start).
+**Stopped at rest; `onboot=0`.** Tools: bpftrace, BCC, sysstat, iotop,
+sysbench, fio, iperf3, stress-ng, perf, smartmontools, nvme-cli, hwloc…
 
 ```bash
-knelperf-toolbox run 'iostat -x 1 5'          # starts LXC if stopped
-knelperf-toolbox run 'bpftrace -e "tracepoint:block:block_rq_issue { @[comm] = count(); }" -c "sleep 5"'
-knelperf-toolbox run 'sar -A -f /host/var/log/sysstat/sa06'   # host sar, offline
-knelperf-toolbox shell                          # interactive
-knelperf-toolbox stop                           # back to zero footprint
+knelerf-toolbox run 'iostat -x 1 5'          # starts LXC if stopped
+knelerf-toolbox run 'bpftrace -e "tracepoint:block:block_rq_issue { @[comm] = count(); }" -c "sleep 5"'
+knelerf-toolbox run 'sar -A -f /host/var/log/sysstat/sa06'   # host sar, offline
+knelerf-toolbox run 'smartctl -d sat -H /dev/sda'            # SAT devices need -d sat; NVMe doesn't
+knelerf-toolbox shell                          # interactive
+knelerf-toolbox stop                           # back to zero footprint
 ```
 
 Docker-capable hosts use the same manifest as an image: