feat: switch macOS learning mode from fs_usage to eslogger

Replace fs_usage (reports Mach thread IDs, requiring process name matching
with false positives) with eslogger (Endpoint Security framework, reports
real Unix PIDs via audit_token.pid plus fork events for process tree tracking).

Key changes:
- Daemon starts eslogger instead of fs_usage, with early-exit detection
  and clear Full Disk Access error messaging
- New two-pass eslogger JSON parser: pass 1 builds PID tree from fork
  events, pass 2 filters filesystem events by PID set
- Remove runtime PID polling (StartPIDTracking, pollDescendantPIDs) —
  process tree is now built post-hoc from the eslogger log
- Platform-specific generateLearnedTemplatePlatform() for darwin/linux/stub
- Refactor TraceResult and GenerateLearnedTemplate to be platform-agnostic

internal/sandbox/learning_linux_test.go

@@ -233,10 +233,10 @@ func TestExtractReadPath(t *testing.T) {
 	}
 }
 
-func TestCheckStraceAvailable(t *testing.T) {
+func TestCheckLearningAvailable(t *testing.T) {
 	// This test just verifies the function doesn't panic.
 	// The result depends on whether strace is installed on the test system.
-	err := CheckStraceAvailable()
+	err := CheckLearningAvailable()
 	if err != nil {
 		t.Logf("strace not available (expected in some CI environments): %v", err)
 	}