pub fn classify_mount(fs_type: &str, dev_name: &str, mnt_root: &str) -> bool
Classify whether a mount entry is suspicious.
Flags unusual tmpfs/ramfs mounts and overlay mounts outside known container runtime paths.