Add followChildren default to tetragon shell-execution TracingPolicy

The Tetragon CRD defaults followChildren to false in matchBinaries,
causing ArgoCD ServerSideDiff to detect a permanent diff.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/tetragon/tracing-policies/process-execution.yaml

@@ -20,6 +20,7 @@ spec:
                 - "59"  # execve
           matchBinaries:
             - operator: In
+              followChildren: false
               values:
                 - /bin/sh
                 - /bin/bash