Fix darwin cmdline fetching with ps-based implementation and add CI workflows

[Copilot]

Darwin cmdline fetching via sysctl kern.procargs2 was broken. Replaced with ps command parsing for both darwin and existing linux implementations to ensure reliable process allowlist validation.

Changes

• Darwin cmdline implementation: Switched from sysctl binary parsing to ps -p <pid> -o args= for command line and ps -p <pid> -o comm= for executable path
• Test coverage: Added cmdline_darwin_test.go and cmdline_linux_test.go to validate cmdline construction and process validation on both platforms
• CI workflows: Added .github/workflows/test-{linux,macos}.yml that run only cmdline retrieval tests without requiring FUSE setup

Implementation

// Before: Complex sysctl binary parsing with argc/argv extraction
func getProcArgs(pid uint32) ([]string, error) {
    buf, err := unix.SysctlRaw(fmt.Sprintf("kern.procargs2.%d", pid))
    // ... 50+ lines of binary parsing ...
}

// After: Simple ps command parsing
func getProcArgs(pid uint32) ([]string, error) {
    cmd := exec.Command("ps", "-p", fmt.Sprintf("%d", pid), "-o", "args=")
    output, err := cmd.Output()
    // Parse and split on whitespace
}

The ps-based approach matches the allowlist pattern matching behavior (whitespace-split arguments) and eliminates platform-specific binary parsing complexity.

CI Configuration

The workflows run targeted cmdline tests using -run "Cmdline|ExePath|ValidateCmdline|ProcCmdline" to test only the process command line retrieval functionality without requiring FUSE installation, making CI faster and simpler.

Original prompt

Create macos and linux workflow files for running the tests of our project.

Currently for darwin or cmdline fetching behavior is broken, we should use the ps command and parse the output. Use the flags to display the cmdline on mac; we parse the output construct the allowlist.

Write tests for both platform to validate that the approaches are working. We must be able to construct the cmdline on both platforms.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[evict]

@copilot let's only run the tests that do not require using the FUSE setup. Only the cmdline retrieval for now.

[Copilot]

Updated both workflows to only run cmdline tests without FUSE setup. Removed macFUSE and fuse3 installation steps since they're not needed for these tests. (de73c25)