Ruby probe (TracePoint): Rails, Sinatra, Rack #77

Part of #51. A probe for Ruby apps (Rails, Sinatra, Rack), built on the shared contract in #73.

Usage: RUBYOPT="-r/opt/secfoo/probe/ruby/secfoo_probe" bundle exec puma

Approach:

• Ruby 3.0+. For each watched method (Build a vulnerable-function watchlist from advisories #52 notation Class#instance_method / Class.class_method), create a TracePoint that is enabled only for that method (TracePoint#enable(target:)), so unwatched code costs nothing. Count calls and sample caller_locations once.
• Inventory (Runtime package inventory: loaded versions, drift and live advisories #68): Gem.loaded_specs for gem name, version and path.
• Routes (Attribute runtime hits to live traffic (route, auth state) #69): Rack middleware. Rails' route pattern (action_dispatch.route_uri_pattern), then the Sinatra route, then unknown.
• Forking servers (Puma cluster, Unicorn, Sidekiq): reconnect to the sensor after fork (Process._fork hook, Ruby 3.1+, with a fallback to at_fork style hooks).

Must not: read arguments or locals (binding), or raise into app code.

Done when: Rails and Sinatra sample apps pass the #73 conformance kit, including a forked Puma cluster, and the PR includes an overhead benchmark.