Toolbox: PVE9 apparmor via lxc.conf, runtime tracefs/debugfs mounts (#826)

- PVE 9 dropped 'pct set --raw.lxc': lxc.apparmor.profile goes straight
  into /etc/pve/lxc/<vmid>.conf and PVE::LXC honors it over the generated
  profile (verified: /proc/self/attr/current = unconfined)
- pct skips virtual-fs bind sources (mp /proc,/sys/kernel/* landed empty):
  keep cgroupfs + /var/log binds, wrapper mounts tracefs/debugfs at start
- bpftrace PROVEN against host kernel (2689 tracepoints, live syscall
  counts showing host pvestatd/vgs); bcc-tools -> bpfcc-tools (bookworm)
- smartctl on SAT devices needs -d sat (recipes updated)

Redmine: https://projects.knownelement.com/issues/826

monitoring/toolbox/toolbox-pkgs.txt

@@ -2,7 +2,7 @@
 # Docker image variant. One package (or apt argument) per line; # = comment.
 # Docs: https://community.turnsys.com/t/328
 bpftrace
-bcc-tools
+bpfcc-tools
 sysstat
 iotop
 sysbench