Vouch request: @bizwillie

[bizwillie]

What do you want to work on?

1. Report the process start time (field 22 of /proc//stat) next to the pid in network audit events.

2. Files: crates/openshell-ocsf/src/objects/process.rs (add created_time / uid), crates/openshell-supervisor-network/src/procfs.rs (a helper to read it) and crates/openshell-supervisor-network/src/proxy.rs (ResolvedIdentity, plus the actor_process(...) calls).

It's for auditing only and doesn't change policy decisions.

Will probably need to include some simple tests too: OCSF serialization, plus parsing a process name with spaces or parentheses.

This links to a few other issues or vouch requests: #2291 (the design calls for pid + start time), #4887 (the pidfd side of this), #4268 (the process-event side).

Why this change?

Interested in the Agent Identity portion of this so have been experimenting with a multi-agent application for hike/drone adventures built on openshell. Right now: a pid can't tell two Claude processes apart once the pid is reused, so the audit log can blame the wrong process. The start time is already read internally and then thrown away, so the change is small. This identifies one process instance, and it's only unique until reboot.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md