fix: report exec event from syscall exit instead of syscall entry

[RonFed]

Durrng testing and reducing the duration filter to zero, observed that processes can have the /proc files in an unstable state - probably not ready yet.
This lead to logs liks:

{"time":"2025-08-04T11:40:17.084570751Z","level":"WARN","msg":"skipping process event due to env prefix not present","pid":6186,"envPrefixFilter":"ODIGOS_POD_NAME","cmdLine":"runc init","exePath":"/membership"}

The cmdline and the exe link seems inconsistent. In addition the environ files does not contain the expected env vars - which leads to the filtering of the event.
Adding an exit tracepoint to the eceve syscall and reporting to user space from there solves that behavior.

In addition, the duration_filter will be used as a passthrough filter if the duration passed is zero.

emergency-ticket id: EMR-5