feat: add capability-aware TCP evidence

[yairfalse]

Summary

• add deterministic mock TCP evidence inputs for backend, RTT, retransmits, resets, connection failures, and congestion events
• normalize eBPF mode aliases and report Linux capability state for CAP_BPF/CAP_PERFMON or CAP_SYS_ADMIN
• document mock TCP evidence knobs in the README

Validation

• cargo fmt --check
• cargo test -p control observability::ebpf
• cargo test -p control
• cargo clippy -p control --all-targets -- -D warnings