fix(SECURE-3323): exclude vulnerable obi/beyla.ebpf via noebpf build tag

[jace-son]

Summary

Excludes the vulnerable go.opentelemetry.io/obi (CVE-2026-41433, GHSA-8gmg-3w2q-65f4, High / CVSS 8.4) from the alloy binary via a new noebpf build tag, instead of upgrading obi.

Ref: SECURE-3323

⚠️ Draft — holding for security sign-off on direction. See the SECURE-3323 comment for the full analysis and alternatives considered. Not for merge until security confirms this approach (vs. risk-acceptance or a full obi+beyla+collector upgrade).

Why not just bump obi?

obi is tightly coupled to grafana/beyla/v3 (shared otelcfg types) and the otel-collector ecosystem. The fix is in obi v0.8.0 / grafana fork tag v1.20.0, but bumping obi alone breaks the build:

beyla/v3 v3.6.0 vs obi v1.20.0:
cfg.MaxQueueSize undefined (type *otelcfg.TracesConfig has no field MaxQueueSize)

A coupled bump (obi + beyla/v3 + collector) churns 240+ deps (collector v1.53 -> v1.55, contrib v0.147 -> v0.149). Upstream grafana/alloy main itself is still on a pre-fix obi (fork v1.18.4), so we'd be ahead of upstream.

Why this is safe

We don't use beyla.ebpf anywhere (no beyla/OBI references in ops-k8s; our alloy config only uses pyroscope.ebpf + xnet-exporter). The vulnerable Java-injection path is not reachable in our deployment.

The beyla.ebpf component already ships a noop placeholder (beyla_placeholder.go) for non-linux platforms. This PR makes the noebpf build tag select that placeholder on linux too, so obi + beyla/v3 drop out of the binary entirely. The component stays registered — configs still parse; enabling beyla.ebpf just logs a warning.

Changes

• internal/component/beyla/ebpf/beyla_linux.go — add && !noebpf to build constraint
• internal/component/beyla/ebpf/beyla_linux_test.go — same
• internal/component/beyla/ebpf/beyla_placeholder.go — add || noebpf to build constraint
• Dockerfile — add noebpf to GO_TAGS

Verification

go list -deps (collector module):
  baseline:  122 obi/beyla packages
  noebpf:      0 obi/beyla packages

beyla.ebpf file selection:
  linux/amd64, no tag   -> beyla_linux.go       (unchanged behavior)
  linux/amd64, noebpf   -> beyla_placeholder.go (obi excluded)
  darwin                -> beyla_placeholder.go (unchanged behavior)

• Build-constraint pair verified complementary (exactly one file active per config; args.go shared by both).
• beyla.ebpf package compiles with and without the tag.
• Full local binary link is blocked by unrelated CGO/Oracle (godror) + pyroscope/ebpf env issues that reproduce identically on the baseline — not introduced by this change.

🤖 Generated with Claude Code

[jinsekim]

LGTM!

[jinsekim]

LGTM!