execsnoop: Instrument sys_execve first

On my kernel (3.16 amd64), stub_execve can't be instrumented, and
do_execve gets instrumented but fails silently (no events are caught).

Print which implementation is used.
Make sure do_execve is tried last due to silent failures.