fix(gpu): gate the event monitor on enable_ebpf_probes (#54372)

### What does this PR do?

Gates the system-probe event monitor on `gpu_monitoring.enable_ebpf_probes` in
addition to `gpu_monitoring.enabled`, in both the module-enablement logic
(`pkg/system-probe/config`) and the GPU process-consumer creation
(`cmd/system-probe/modules/eventmonitor.go`).

The GPU monitoring module itself remains gated on `gpu_monitoring.enabled`, so
NVML-based collection is unchanged.

### Motivation

The event monitor exists only to feed process exec/exit events to the GPU eBPF
probes. Keyed on `gpu_monitoring.enabled` alone, a host running GPU monitoring
through NVML only still loaded the event monitor's eBPF programs and built a
process consumer that nothing read.

Follow-up to the discussion on #54291.

### Describe how you validated your changes

Extended `TestEventMonitor` with the `enabled` × `enable_ebpf_probes` matrix,
setting both explicitly rather than relying on the default (which is changing as
the probes are deprecated). Verified that with the probes disabled the `gpu`
module is still enabled while `event_monitor` is not:

| `gpu_monitoring.enabled` | `enable_ebpf_probes` | enabled modules |
| --- | --- | --- |
| true | true | `discovery, event_monitor, gpu` |
| true | false | `discovery, gpu` |
| false | true | `discovery` |

Also built `cmd/system-probe/modules` with `linux_bpf,nvml` to cover the
configuration that includes both `eventmonitor.go` and the real `gpu.go`.

### Additional Notes

Both gates had to move together to stay consistent with the
`EnableEBPFProbes && processEventConsumer == nil` guard in the GPU module
factory.

Note that `gpu_monitoring.enable_ebpf_probes` still defaults to `true` on `main`,
so this is a no-op for default configurations until #54291 lands; it currently
only affects deployments that set it to `false` explicitly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


Co-authored-by: matteo.bertrone <matteo.bertrone@datadoghq.com>

Author: mbertrone

cmd/system-probe/modules/eventmonitor.go

@@ -133,7 +133,11 @@ func createEventMonitorModule(_ *sysconfigtypes.Config, deps module.FactoryDepen
 	}
 
 	gpucfg := gpuconfig.New()
-	if gpucfg.Enabled {
+	// Only the eBPF probes consume these events, so skip the consumer entirely
+	// when they are disabled. Kept in sync with the module gate in
+	// pkg/system-probe/config, which does not enable the event monitor for GPU
+	// monitoring unless the probes are enabled too.
+	if gpucfg.Enabled && gpucfg.EnableEBPFProbes {
 		err := createGPUProcessEventConsumer(evm)
 		if err != nil {
 			return nil, fmt.Errorf("cannot create event consumer for GPU: %w", err)

pkg/system-probe/config/config.go

@@ -127,6 +127,9 @@ func load() (*types.Config, error) {
 	eudmEnabled := coreCfg.GetString("infrastructure_mode") == "end_user_device"
 	csmEnabled := cfg.GetBool(secNS("enabled"))
 	gpuEnabled := cfg.GetBool(gpuNS("enabled"))
+	// The GPU module only consumes process events when its eBPF probes are
+	// loaded, so the event monitor is only needed for that combination.
+	gpuEBPFProbesEnabled := gpuEnabled && cfg.GetBool(gpuNS("enable_ebpf_probes"))
 	diEnabled := cfg.GetBool(diNS("enabled"))
 	swEnabled := coreCfg.GetBool(swNS("enabled"))
 	discoveryServiceMapEnabled := cfg.GetBool(discoveryNS("service_map", "enabled"))
@@ -145,7 +148,7 @@ func load() (*types.Config, error) {
 		coreCfg.GetBool("sbom.enrichment.usage.enabled") ||
 		(usmEnabled && cfg.GetBool(smNS("enable_event_stream"))) ||
 		(c.ModuleIsEnabled(NetworkTracerModule) && cfg.GetBool(evNS("network_process.enabled"))) ||
-		gpuEnabled ||
+		gpuEBPFProbesEnabled ||
 		diEnabled {
 		c.EnabledModules[EventMonitorModule] = struct{}{}
 	}

pkg/system-probe/config/config_test.go

@@ -23,6 +23,7 @@ func TestEventMonitor(t *testing.T) {
 
 	for i, tc := range []struct {
 		cws, fim, networkEvents, gpu bool
+		gpuEBPFProbes                bool
 		usmEvents                    bool
 		enabled                      bool
 	}{
@@ -34,7 +35,11 @@ func TestEventMonitor(t *testing.T) {
 		{cws: false, fim: true, networkEvents: true, enabled: true},
 		{cws: true, fim: false, networkEvents: true, enabled: true},
 		{cws: true, fim: true, networkEvents: true, enabled: true},
-		{cws: false, fim: false, networkEvents: false, gpu: true, enabled: true},
+		// GPU monitoring only needs the event monitor to feed its eBPF probes,
+		// so both settings have to be enabled for the module to be pulled in.
+		{cws: false, fim: false, networkEvents: false, gpu: true, gpuEBPFProbes: true, enabled: true},
+		{cws: false, fim: false, networkEvents: false, gpu: true, gpuEBPFProbes: false, enabled: false},
+		{cws: false, fim: false, networkEvents: false, gpu: false, gpuEBPFProbes: true, enabled: false},
 		{usmEvents: true, enabled: true},
 	} {
 		t.Run(strconv.Itoa(i), func(t *testing.T) {
@@ -44,6 +49,9 @@ func TestEventMonitor(t *testing.T) {
 			t.Setenv("DD_SYSTEM_PROBE_EVENT_MONITORING_NETWORK_PROCESS_ENABLED", strconv.FormatBool(tc.networkEvents))
 			t.Setenv("DD_SYSTEM_PROBE_NETWORK_ENABLED", strconv.FormatBool(tc.networkEvents))
 			t.Setenv("DD_GPU_MONITORING_ENABLED", strconv.FormatBool(tc.gpu))
+			// Set explicitly rather than relying on the default, which is
+			// subject to change as the eBPF probes are deprecated.
+			t.Setenv("DD_GPU_MONITORING_ENABLE_EBPF_PROBES", strconv.FormatBool(tc.gpuEBPFProbes))
 			t.Setenv("DD_SYSTEM_PROBE_SERVICE_MONITORING_ENABLED", strconv.FormatBool(tc.usmEvents))
 			t.Setenv("DD_SERVICE_MONITORING_CONFIG_ENABLE_EVENT_STREAM", strconv.FormatBool(tc.usmEvents))