perf(memtrack): drain ringbuf bursts eagerly and reserve poller cores

Two consumer-side fixes for event drops under allocation bursts:

- After each poll() the poller keeps calling consume_raw() until the
  ring buffer reads empty, draining bursts without paying an epoll
  wakeup round-trip per poll cycle.
- The encode pipeline no longer claims every core: rayon workers on all
  cores starve the poll thread (and the tracked command), which is what
  let the ring buffer fill up. Reserve two cores.

Refs COD-3071

Author: not-matthias

crates/memtrack/src/ebpf/poller.rs

@@ -39,6 +39,12 @@ impl RingBufferPoller {
             move || {
                 while !shutdown.load(Ordering::Relaxed) {
                     let _ = ringbuf.poll(timeout);
+
+                    // Records produced while poll() was draining are consumed
+                    // directly (no epoll_wait syscall) until the buffer reads
+                    // empty, so bursts are drained at full speed instead of
+                    // paying a wakeup round-trip per poll cycle.
+                    while ringbuf.consume().is_ok() {}
                 }
 
                 // Events may still be sitting in the ring buffer after the last

crates/memtrack/src/main.rs

@@ -126,8 +126,11 @@ fn track_command(
     let file_name = MemtrackArtifact::file_name(Some(root_pid));
     let out_file = std::fs::File::create(out_dir.join(file_name))?;
 
+    // Leave headroom for the ring buffer poll thread and the tracked
+    // command: encode workers on every core starve the poller during
+    // allocation bursts, which overflows the kernel ring buffer.
     let n_workers = thread::available_parallelism()
-        .map(|n| n.get())
+        .map(|n| n.get().saturating_sub(2).max(1))
         .unwrap_or(4);
 
     let pipeline_thread = thread::spawn(move || encode_events(event_rx, out_file, n_workers));