restrict_syscalls now uses seccomp-bpf to track syscalls instead of ptrace for better performance.