feat: switch macOS learning mode from fs_usage to eslogger

Replace fs_usage (reports Mach thread IDs, requiring process name matching
with false positives) with eslogger (Endpoint Security framework, reports
real Unix PIDs via audit_token.pid plus fork events for process tree tracking).

Key changes:
- Daemon starts eslogger instead of fs_usage, with early-exit detection
  and clear Full Disk Access error messaging
- New two-pass eslogger JSON parser: pass 1 builds PID tree from fork
  events, pass 2 filters filesystem events by PID set
- Remove runtime PID polling (StartPIDTracking, pollDescendantPIDs) —
  process tree is now built post-hoc from the eslogger log
- Platform-specific generateLearnedTemplatePlatform() for darwin/linux/stub
- Refactor TraceResult and GenerateLearnedTemplate to be platform-agnostic

internal/sandbox/learning_test.go

@@ -421,22 +421,21 @@ func TestGenerateLearnedTemplate(t *testing.T) {
 	tmpDir := t.TempDir()
 	t.Setenv("XDG_CONFIG_HOME", tmpDir)
 
-	// Create a fake strace log
 	home, _ := os.UserHomeDir()
-	logContent := strings.Join([]string{
-		`12345 openat(AT_FDCWD, "` + filepath.Join(home, ".cache/testapp/db.sqlite") + `", O_WRONLY|O_CREAT, 0644) = 3`,
-		`12345 openat(AT_FDCWD, "` + filepath.Join(home, ".cache/testapp/version") + `", O_WRONLY|O_CREAT, 0644) = 3`,
-		`12345 mkdirat(AT_FDCWD, "` + filepath.Join(home, ".config/testapp") + `", 0755) = 0`,
-		`12345 openat(AT_FDCWD, "/tmp/somefile", O_WRONLY|O_CREAT, 0644) = 3`,
-		`12345 openat(AT_FDCWD, "/proc/self/maps", O_RDONLY) = 3`,
-	}, "\n")
 
-	logFile := filepath.Join(tmpDir, "strace.log")
-	if err := os.WriteFile(logFile, []byte(logContent), 0o600); err != nil {
-		t.Fatal(err)
+	// Build a TraceResult directly (platform-independent test)
+	result := &TraceResult{
+		WritePaths: []string{
+			filepath.Join(home, ".cache/testapp/db.sqlite"),
+			filepath.Join(home, ".cache/testapp/version"),
+			filepath.Join(home, ".config/testapp"),
+		},
+		ReadPaths: []string{
+			filepath.Join(home, ".config/testapp/conf.json"),
+		},
 	}
 
-	templatePath, err := GenerateLearnedTemplate(logFile, "testapp", false)
+	templatePath, err := GenerateLearnedTemplate(result, "testapp", false)
 	if err != nil {
 		t.Fatalf("GenerateLearnedTemplate() error: %v", err)
 	}