ICMP check uses unprivileged UDP ping by default — fails on most Linux hosts without sysctl tuning

[dolph]

What breaks

pinger.go creates a pro-bing pinger and never calls SetPrivileged(true):

// pinger.go:11-18
pinger, err := probing.NewPinger(ip.String())
...
pinger.Count = 1
err = pinger.Run()

pro-bing's New() defaults protocol = "udp" (unprivileged ICMP-over-UDP datagram sockets). The behavior of that mode differs significantly by OS:

OS	Unprivileged ICMP UDP works?
Linux	Only if net.ipv4.ping_group_range includes the running user's GID. On most distros it defaults to 1 0 (disabled). Result: socket: permission denied for any non-root run.
macOS	Works out of the box for ordinary users.
Windows	Does not work — Windows has no equivalent unprivileged ICMP socket. pro-bing falls back to raw sockets, which requires Administrator.
FreeBSD	Not supported at all.

This means on a typical Linux server (the apparent primary target — see #26, statsd defaults, /etc config path), icmp:// destinations silently fail with a permission error unless the operator either:

1. Runs the binary as root, or
2. Sets sysctl -w net.ipv4.ping_group_range="0 2147483647", or
3. The binary is given cap_net_raw capability.

None of this is documented, and the error reported through LogRouteError is just "Failed to setup ping to X: socket: permission denied", which is hard to act on.

Suggested fix

Pick one of:

1. Default to privileged mode + document the requirement. Call pinger.SetPrivileged(true) (uses raw ICMP sockets) and document that the binary needs to run as root or have CAP_NET_RAW. This matches the Linux-server deployment model and works consistently on Windows (with Admin) and macOS (with root). The release pipeline could even set the capability on the binary via a post-build step.

2. Auto-detect and fall back. Try privileged first; if EPERM/EACCES, try unprivileged. Surface a single clear log message about which mode is in use.

3. Expose a config option (icmp_privileged: true/false in connectivity.yml) and document the trade-offs in the README.

At minimum, the error message in pinger.go:14,21 should mention the unprivileged-ICMP requirement so users hit by this on Linux know what to do.