feat(config): harden kernel for production container workloads

[PeronGH]

Add security, performance, and diagnostic options identified by comparing ArcBox configs against boot-assets and Apple containerization kernels. All options validated via olddefconfig on both architectures.

P0 - BPF JIT (BPF_JIT, BPF_JIT_ALWAYS_ON) for seccomp-bpf performance
P0 - AppArmor + Yama LSM for container security isolation
P1 - Audit subsystem for security event logging
P1 - Transparent HugePages (madvise) + CGROUP_HUGETLB for OCI spec
P2 - INET_DIAG/NETLINK_DIAG for network diagnostics (ss command)
P2 - KALLSYMS for meaningful kernel panic traces
P2 - Explicit EPOLL/SIGNALFD/TIMERFD/EVENTFD/AIO declarations
P3 - RD_ZSTD for zstd-compressed initramfs support

[Copilot]

Pull request overview

This PR updates the ArcBox kernel build configs to better support production container workloads by enabling additional security (LSMs/audit), performance (BPF JIT/THP), and diagnostics (netlink/inet diag, kallsyms) features, while keeping the configs compatible via olddefconfig for both x86_64 and arm64 builds.

Changes:

• Enable eBPF JIT (including always-on) and add audit subsystem options.
• Add container/OCI-related memory features (THP madvise + hugetlb/cgroup hugetlb).
• Enable network and kernel diagnostics options (INET/NETLINK diag, KALLSYMS) and initramfs zstd support.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
configs/arcbox-x86_64.config	Enables additional container-focused security/perf/diagnostic kernel options for the x86_64 ArcBox kernel build.
configs/arcbox-arm64.config	Mirrors the same container-focused security/perf/diagnostic kernel options for the arm64 ArcBox kernel build.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.