audit: anchor all pid references in the initial pid namespace