Building a Custom eBPF Filesystem Watcher to Catch Root Ownership Goofs