fix(audit-sidecar): add macOS compatibility for workspace builds

[denverbaumgartner]

Summary

• Makes cargo build --workspace succeed on macOS by making the aya crate (eBPF userspace library) Linux-only
• The audit sidecar runs in "stub mode" on non-Linux platforms (no eBPF monitoring) while preserving full functionality on Linux

Changes

File	Change
Cargo.toml	Move aya dependency to [target.'cfg(target_os = "linux")'.dependencies]
loader.rs	Add module-level #![cfg(all(feature = "ebpf", target_os = "linux"))]
main.rs	Update cfg attributes to require both ebpf feature AND Linux

Problem

The aya crate uses Linux-specific APIs (netlink, bpf syscalls) that cause compilation failures on macOS:

error[E0432]: unresolved imports `libc::nlattr`, `libc::nlmsgerr`, `libc::nlmsghdr`

Solution

Use Cargo's target-specific dependencies combined with conditional compilation to:

1. Only include aya as a dependency on Linux
2. Only compile the eBPF loader module on Linux with the ebpf feature
3. Run in stub mode on other platforms

Verification

• ✅ cargo build --workspace passes on macOS
• ✅ cargo test -p loom-weaver-audit-sidecar passes (19 tests)
• ⏳ Linux builds unchanged (verified by structure - no functional changes to Linux code paths)

Test plan

• Build workspace on macOS
• Run audit-sidecar unit tests
• Verify Linux CI passes (if available)

🤖 Generated with Claude Code