Build the ARM64 kernel capability probe and baseline manifest

[enkerewpo]

Goal

Produce a read-only probe that records whether an ARM64 Linux system can run the
Neo baseline without guessing from a release number.

Initial scope

• kernel release, commit identity, config hash, and taint state;
• cgroup v2 controllers and delegation;
• PSI availability;
• BPF, BTF, ring buffer, tracing, and BPF LSM capabilities;
• sched_ext availability and supported operations;
• PREEMPT model, SCHED_DEADLINE, CPU topology, cpusets, IRQ affinity, and
  isolation settings;
• relevant device, firmware, and driver identity;
• QEMU virt as the first reproducible platform.

Acceptance

• emits a stable machine-readable manifest and a short human report;
• distinguishes missing, disabled, unsupported, and permission-denied states;
• runs without changing system configuration;
• includes fixtures or tests for at least QEMU ARM64 and one intentionally
  incomplete capability set;
• records the exact kernel commit, config, and toolchain used in CI.