collector: add tainted collector for /proc/sys/kernel/tainted

[arunsrini3082]

Summary

Add a tainted collector that exposes kernel taint flags from
/proc/sys/kernel/tainted as Prometheus metrics.

This revives the idea originally proposed in #1567. The review feedback
from that PR has been addressed:

• Parsing is moved to the prometheus/procfs library (companion PR:
  procfs: add KernelTainted() to parse /proc/sys/kernel/tainted procfs#844)
• Metric uses labels instead of one metric per bit:
  node_kernel_tainted{bit="14", flag="L"} 1

Metrics

node_kernel_tainted{bit="14", flag="L"} 0
node_kernel_tainted{bit="12", flag="O"} 1

One series per known taint bit (20 total), value 0 or 1.
Disabled by default — enable with --collector.tainted.

Dependencies

⚠️ This PR depends on prometheus/procfs#844 being merged first.
The go.mod procfs version will be bumped before merging once
that PR is released.

Reference

https://www.kernel.org/doc/html/latest/admin-guide/tainted-kernels.html

[arunsrini3082]

Both procfs PRs are now merged:

#844 — KernelTainted() implementation
#847 — fix linux build tag (was !windows, caused crossbuild failures on OpenBSD/NetBSD/DragonFly/Solaris)

No new procfs release has been cut yet, so I've temporarily pinned go.mod to the merged commit pseudo-version to unblock CI. Will update to the proper release tag once available.

[arunsrini3082]

Built and tested in our environment. All 20 taint flags are correctly exposed:

vasudeva.sk:~/kernel_taints$ curl -s 0:9100/metrics | grep node_kernel_tainted
# HELP node_kernel_tainted Taint flags set on the running Linux kernel, as reported by /proc/sys/kernel/tainted. Value is 1 if the flag is set, 0 otherwise. See https://www.kernel.org/doc/html/latest/admin-guide/tainted-kernels.html for flag meanings.
# TYPE node_kernel_tainted gauge
node_kernel_tainted{bit="0",flag="P"} 0
node_kernel_tainted{bit="1",flag="F"} 0
node_kernel_tainted{bit="2",flag="S"} 0
node_kernel_tainted{bit="3",flag="R"} 0
node_kernel_tainted{bit="4",flag="M"} 0
node_kernel_tainted{bit="5",flag="B"} 0
node_kernel_tainted{bit="6",flag="U"} 0
node_kernel_tainted{bit="7",flag="D"} 0
node_kernel_tainted{bit="8",flag="A"} 0
node_kernel_tainted{bit="9",flag="W"} 0
node_kernel_tainted{bit="10",flag="C"} 0
node_kernel_tainted{bit="11",flag="I"} 0
node_kernel_tainted{bit="12",flag="O"} 0
node_kernel_tainted{bit="13",flag="E"} 0
node_kernel_tainted{bit="14",flag="L"} 0
node_kernel_tainted{bit="15",flag="K"} 0
node_kernel_tainted{bit="16",flag="X"} 0
node_kernel_tainted{bit="17",flag="T"} 0
node_kernel_tainted{bit="18",flag="N"} 0
node_kernel_tainted{bit="19",flag="J"} 0

This is on a clean kernel (all flags 0). The collector is working as expected.

[nicolastakashi]

blocking: needs the year-less copyright header, // Copyright The Prometheus Authors. make check_license rejects 2024 here.

[nicolastakashi]

blocking: same header issue as tainted_linux.go.

[nicolastakashi]

blocking: this pins procfs to an untagged pseudo-version (v0.21.2-0.20260717070424-0cd18237af6e). Rebase onto master and point to a tagged release once one includes #844/#847. Can't merge on an untagged commit.