WP1d: LD_PRELOAD detection on process exec

[Brad-Edwards]

Context

LD_PRELOAD is the simplest injection vector on Linux. No detection of it at exec time.

Work

• New daemon/preload_detect.{h,c}: on PROCESS_EXEC events, read /proc/<pid>/environ, scan for LD_PRELOAD=. Emit OWL_EVENT_LIB_UNEXPECTED (0x0203) if found.
• New tests/test_preload_detect.c
• Modify daemon/event_pipeline.c: call preload check on exec events

Tests

5 unit tests (LD_PRELOAD present, absent, null environ, partial read, multiple env vars). 1 E2E.

Part of v2.0.0