feat: support exempt_files to skip source code overwrite detection

[hemantkumar-dev]

Summary

Honors a new exempt_files config value so that specific files can be excluded from source code overwrite detection, while file monitoring stays enabled for everything else.

Problem

Source code overwrite detection currently applies to every source file under the working directory. The only way to quiet it for expected writes (for example generated bundles or lock files) is disable_file_monitoring, which disables monitoring for the whole job. There was no way to exempt individual files.

This is the agent side of step-security/harden-runner#330. The action change that surfaces the exempt-files input and sends exempt_files in the agent config is in step-security/harden-runner#678.

Fix

• Parse the newline-separated exempt_files value from the agent config into a list of paths (parseExemptFiles). Splitting on newlines only keeps paths that contain spaces intact.
• Thread the list from config through ProcessMonitor to EventHandler.
• In handleFileEvent, skip source code overwrite tracking for a file when it matches an exempt path. Exempt entries are usually repo-relative while events carry absolute paths, so matching is done on the full path or a trailing path segment.

When exempt_files is empty (the default) behavior is unchanged.

Files changed

File	Change
config.go	Parse exempt_files into []string via parseExemptFiles
procmon.go	Add ExemptFiles to ProcessMonitor
agent.go	Pass ExemptFiles from config to the monitor
procmon_linux.go	Pass ExemptFiles into the EventHandler
eventhandler.go	Add isExemptFile and skip overwrite detection for exempt files

Testing

• go test ./... — added Test_parseExemptFiles (newline handling, CRLF, blank lines, spaces in paths) and TestEventHandler_isExemptFile (exact, suffix, space-in-path, and negative matches)
• gofmt

Related to step-security/harden-runner#330
Companion action PR: step-security/harden-runner#678