Toolbox: PVE9 apparmor via lxc.conf, runtime tracefs/debugfs mounts (#826)

- PVE 9 dropped 'pct set --raw.lxc': lxc.apparmor.profile goes straight
  into /etc/pve/lxc/<vmid>.conf and PVE::LXC honors it over the generated
  profile (verified: /proc/self/attr/current = unconfined)
- pct skips virtual-fs bind sources (mp /proc,/sys/kernel/* landed empty):
  keep cgroupfs + /var/log binds, wrapper mounts tracefs/debugfs at start
- bpftrace PROVEN against host kernel (2689 tracepoints, live syscall
  counts showing host pvestatd/vgs); bcc-tools -> bpfcc-tools (bookworm)
- smartctl on SAT devices needs -d sat (recipes updated)

Redmine: https://projects.knownelement.com/issues/826

monitoring/toolbox/knelperf-toolbox

@@ -1,5 +1,5 @@
 #!/bin/sh
-# knelerf-toolbox — front door to the on-demand perf toolbox LXC on this node.
+# knelperf-toolbox — front door to the on-demand perf toolbox LXC on this node.
 # usage: knelperf-toolbox run '<cmd>'   (starts the LXC if stopped, runs, leaves it up)
 #        knelperf-toolbox shell         (interactive)
 #        knelperf-toolbox start|stop|status
@@ -8,13 +8,20 @@
 VMID=${KNELPERF_TOOLBOX_VMID:-950}
 
 ensure_running() {
-  pct status "$VMID" 2>/dev/null | grep -q running && return 0
-  pct start "$VMID"
-  i=0
-  until pct exec "$VMID" -- true 2>/dev/null; do
-    i=$((i + 1)); [ $i -gt 45 ] && { echo "boot timeout" >&2; return 1; }
-    sleep 2
-  done
+  if ! pct status "$VMID" 2>/dev/null | grep -q running; then
+    pct start "$VMID"
+    i=0
+    until pct exec "$VMID" -- true 2>/dev/null; do
+      i=$((i + 1)); [ $i -gt 45 ] && { echo "boot timeout" >&2; return 1; }
+      sleep 2
+    done
+  fi
+  # host-kernel analysis mounts — pct skips virtual-fs bind sources, so
+  # tracefs/debugfs are mounted at runtime (container is privileged +
+  # apparmor unconfined precisely for this).
+  pct exec "$VMID" -- sh -c '
+    mountpoint -q /sys/kernel/tracing || mount -t tracefs none /sys/kernel/tracing 2>/dev/null
+    mountpoint -q /sys/kernel/debug || mount -t debugfs none /sys/kernel/debug 2>/dev/null'
 }
 
 case "${1:-help}" in