Mirror the regorus-bpf egress backend for an LSM file-open hook. Lower a
regorus-lift EnforcerConfig over the observable fields input.path (Str,
canonicalized in user space) and input.op (read/write/exec) into a fixed
rule plan, with a user-space reference enforcer that the conformance tests
treat as ground truth.

What lowers: Eq/Membership of exact paths and ops, plus a non-negated
startswith(input.path, ...) as a leading-byte prefix. What is dropped
(fail-closed, never approximated): non-observable fields, a second atom on
the same field, negated prefixes, and endswith/contains (a fixed kernel
program cannot match suffix/substring soundly). The non-negotiable
invariant is preserved: enforce == Allow implies full_eval == allow.

bpf/file_open.bpf.c is a CO-RE lsm/file_open program built on the same
self-authored compat shim (no libbpf-dev). It reads a bounded, NON-canonical
bpf_d_path prefix and is documented best-effort (Phase-2 risk); the
user-space enforcer is the conformance reference. It compiles cleanly
against live /sys/kernel/btf/vmlinux.

Tests: triple-path conformance and scenarios #22-23 (file-read allow-list,
no-exec-from-tmp), exporter unit tests, fail-closed/design notes for
#24-27 (signature allow-listing, module lockdown, ptrace/raw-socket,
AI-agent guardrail composition), and a toolchain-gated BPF compile test.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>