perf(memtrack): grow the event ring buffer to 256 MiB

16 MiB holds only ~300K records (~60ms of headroom at multi-M events/s
bursts), so a short consumer scheduling stall overflows the buffer and
drops events. 256 MiB gives ~1s of worst-case burst headroom. The
buffer is memcg-charged and vmap'd, so the only cost is the memory
itself while tracking runs.

Refs COD-3071

Author: not-matthias

crates/memtrack/src/ebpf/c/memtrack.bpf.c

@@ -40,7 +40,7 @@ BPF_HASH_MAP(tracked_pids, __u32, __u8, 10000);
 /* Map to store parent-child relationships to detect hierarchy */
 BPF_HASH_MAP(pids_ppid, __u32, __u32, 10000);
 /* Ring buffer for sending events to userspace */
-BPF_RINGBUF(events, 16 * 1024 * 1024);
+BPF_RINGBUF(events, 256 * 1024 * 1024);
 /* Map to control whether tracking is enabled (0 = disabled, 1 = enabled) */
 BPF_ARRAY_MAP(tracking_enabled, __u8, 1);
 /*  Counter for events that couldn't be added to the ring buffer */