I was hoping some other people working on audit would step up.

One idea I have not tested is to make a "command and control" fd that would
be used for enabling the audit system and setting the pid. This would be
separate from the data fd which processes events.

Looks like we lost that ability a couple years ago when missing auditd 
detection was added. The fd that sets the pid is the one that gets all the 
events even if there is another fd available that belongs to the same pid.