Node.js live sensor (--require hook) #56

Same contract as #55, for Node apps:

node --require @secfoo/sensor app.js   # reads SECFOO_WATCHLIST / SECFOO_EVENTS_OUT

Approach:

• Hook Module._load (CommonJS) and use the module.register loader hooks (ESM, Node ≥ 20.6) to wrap watched exports of watched packages once, when they first load.
• The wrapper increments a counter and captures new Error().stack on the first call only, trimmed to app frames.
• Coverage: optionally enable V8 precise coverage through inspector (Profiler.startPreciseCoverage, with callCount: false and detailed: false to keep it cheap) to fill the session's app function totals.
• Flush on an interval, and on beforeExit/SIGTERM.

The package lives under packaging/ or npm/, next to the existing npm wrapper. Check npm/ for the publishing layout before adding a new package.

Must not: change this, arguments, return values or thrown errors of wrapped functions; or break instanceof and property access on wrapped classes. Test this directly.

Done when: tests cover CJS and ESM sample apps and a wrapped class, and the PR includes an overhead benchmark.

Added for the live sensor (#51 phase 2):

• Output: follow the Probe ↔ sensor protocol and conformance kit (one contract for every runtime) #73 protocol. When SECFOO_SENSOR_ADDR is set, send aggregated lines to the sensor (Standalone runtime sensor (secfoo sensor) as sidecar or host daemon #67) over the address it names (Unix socket, loopback TCP, named pipe, or direct HTTPS for serverless), falling back to SECFOO_EVENTS_OUT. Use a bounded queue, drop on overflow, and unref() timers and sockets so the probe never keeps the process alive.
• Watchlist reload: re-read SECFOO_WATCHLIST when it changes and wrap newly watched exports of already-loaded modules where possible.
• Inventory: emit load lines (Runtime package inventory: loaded versions, drift and live advisories #68).
• Route and auth tagging: read the request context from Attribute runtime hits to live traffic (route, auth state) #69 (AsyncLocalStorage) when it's present.
• Start without code changes: support NODE_OPTIONS=--require / --import (Deploy the runtime sensor anywhere: containers, Kubernetes, VMs, Windows, PaaS, serverless #71).
• Must pass the Probe ↔ sensor protocol and conformance kit (one contract for every runtime) #73 conformance kit.