fix(kernelversions): allow audited RHASH gap in BCC

[leodido]

The weekly refresh fails when current Linux UAPI includes BPF_MAP_TYPE_RHASH but BCC has no minimum-version row for it. Add only RHASH to the existing audited gap list so refresh can complete while unrelated undocumented symbols still fail validation.

Evidence and scope

• Refreshed the audit on 2026-09-06: main is f52dc9f54a6ebe64d002ae39ee41fb99c5555c56, with no open PRs at investigation start. The latest three refresh runs failed; ordinary CI and SAST passed on that main commit.
• August 31 failed job resolved BCC f07cbb734d5d555dc35adf1326393f27eb9e7095 and Linux cee9395acd8043be0644b25c34bfa86623f2b935, then failed in regeneration solely on RHASH, before build verification or PR creation.
• Current BCC table still omits RHASH. BCC HEAD has not moved since that run. Reproduced the same failure locally using current Linux HEAD 88405f0ad1d5c680afe3ea0ce9345fa9e1deaac8 before applying the fix.
• Linux introduced RHASH in 16b4d3e2fb24. It is absent from v7.1 UAPI, present in v7.2-rc1, and included in v7.2 (also verified commit ancestry).

The validator, parser, emitter, dependencies and workflow remain unchanged. End-to-end regression tests exercise the real parser/validator/emitter with controlled HTTP inputs: RHASH alone permits generation without adding a version row; RHASH plus an unrelated unknown map still errors and leaves the existing snapshot untouched. Both tests failed on the original RHASH diagnostic before the gap entry was added.

Generated output and limits

go generate ./internal/kernelversions/... with the committed defaults leaves tables.go byte-for-byte unchanged. Generation against the current upstream commits above now succeeds; its only differences are the two provenance comments, with no version-row changes. Two runs produce identical bytes, and the actual generated file passes tests and vet via a Go overlay.

Keep default pins and the committed snapshot unchanged: CONTRIBUTING.md reserves snapshot bumps for the auto-refresh PR. This fixes its regeneration blocker; it does not run the bot workflow or merge its future snapshot PR.

The pinned cilium/ebpf v0.20.0 map enum ends at Arena and has no named RHASH constant; the generator also has no RHASH mapping. The existing BCC/cilium intersection therefore cannot expose a RHASH version lookup yet. No minimum version is injected or numeric enum invented. When BCC documents it, remove the gap entry; emitting a row also needs a supported cilium constant and explicit mapping. No public API or user-visible table changes, so no README/changelog change is needed.

Validation

• go test ./internal/kernelversions/... -count=1
• go generate ./internal/kernelversions/... and unchanged committed table
• Current-upstream generation twice; byte-identical output, provenance reviewed
• go test -overlay=/tmp/kfeatures-refresh-overlay.json ./internal/kernelversions/... -count=1 and go vet -overlay=/tmp/kfeatures-refresh-overlay.json ./...
• make build
• make test TEST_FLAGS='-race -count=1'
• make cover-check: all six gated files pass the 90% threshold
• make vet
• CI-pinned golangci-lint v1.64.8 run: passes (download checksum verified). Installed v2.1.6 reports eight existing errcheck findings in unchanged code; it is not the CI version.
• bats test/ on macOS: 36 pass, 20 Linux-only skips, zero failures (using Bats support/assert libraries)
• git diff --check

PR rebased onto current main d7b4fd45cbd40c70fea4cbb696394f5012a8bfd1 (v0.8.0). The patch is unchanged after rebase. Fresh validation completed on commit 48c8a6c216a8f1fa386c7e15a19ef8645612c8ab: CI passed Test (1.24), Linux integration (including root mount checks), macOS CLI, and Lint; SAST passed. Local kernel-version tests passed, and the full Bats suite on macOS completed with 48 passes, 23 Linux-only skips, and zero failures. No IMA, release-artifact, or action-runtime changes are included. The PR remains unmerged; recovery of the refresh workflow on main has not yet been verified.