feat(nodejs): make Node.js event loop tracing opt-in, default off

[mayankpande88]

Why

Attaching the libuv probes reads the entire ELF symbol table of every Node.js process's binary, per pid. node is a large statically linked binary with V8 embedded, so this is expensive — a customer CPU profile attributed 17.5% of a core to it:

Process.instrumentNodejs → AttachNodejsProbes
  → ELFFile.GetSymbol → readSymbols        17.5%

What it buys is a single metric: container_nodejs_event_loop_blocked_time_seconds_total.

An org-wide code search returns exactly one hit — the metric's own definition. No dashboard, alert, query, or application code consumes it. It is collected and stored (24 series on our dev cluster) but never read.

Given no current use case, the cost isn't justified by default.

Change

ENABLE_NODEJS_TRACING, default false. Opt-in matches ENABLE_DOTNET_TRACING rather than the always-on Python probes.

Gated before nodejsChecked, so enabling the flag and restarting instruments processes that were skipped while it was off.

Blast radius

Verified, not assumed — limited to that one metric:

• NodejsStats carries only EventLoopBlockedTime
• The probes attach nothing but uv_io_poll_enter/exit and uv_io_cb_enter/exit
• TLS interception for Node.js processes is unaffected — tls.go has no Node-specific handling and works via the libssl/gotls paths
• L7 tracing is unaffected — it reads syscalls, not libuv

Two things reviewers should weigh:

• Anyone with a customer-built dashboard on this metric loses it silently on upgrade.
• If the AI/troubleshooting features discover metrics dynamically by name rather than hardcoding them, a code search wouldn't reveal that. Worth confirming with whoever owns that before merge.

This does not fix the symbol-table cost generally

python.go and tls.go take the same uncached per-pid full-table path and remain always-on:

python.go:58   OpenELFFile → GetSymbol("pthread_cond_timedwait")
tls.go:142     OpenELFFile → GetSymbol(p.symbol)
tls.go:250     OpenELFFile → GetSymbol(writeSymbol/readSymbol)

This PR removes the Node.js share, which happened to dominate that particular customer's profile. #330 caches the lookups by binary identity and is the general fix — the two are complementary, and #330 still matters for the paths that stay always-on (and for anyone who turns Node.js tracing back on).

Testing

go build ./...                    ok  (whole repo)
go vet ./containers/ ./flags/     clean

No behavioural test added — the change is a flag guard on a code path that requires live Node.js processes and eBPF attachment to exercise meaningfully.

[gemini-code-assist]

Code Review

This pull request introduces a new configuration flag, EnableNodejsTracing, which is disabled by default, to control Node.js event loop tracing. It also updates the instrumentNodejs function in containers/process.go to respect this flag, ensuring that Node.js processes are only instrumented when the flag is enabled. I have no feedback to provide.