execsnoop.bt(8) on Linux

The text 66fc8ff5e059, as Debian 11 (Bullseye), Debian 10 (Buster) shipped it.

Trace new processes via exec() syscalls. Uses bpftrace/eBPF.

execsnoop.bt(8) on Linux now