Add the file access protocol, Linux file service and client

[SaladDay]

Adds the Runtime–file service protocol: the agent host uses it to read and write the sandbox file system. The protocol is FUSE-shaped and handle-based, and phase 1 is the Uncached profile.

• internal/sandboxfs/protocol.go defines the protocol:
  • 30 operations and every request/response type;
  • NodeRef, HandleID, Attr, DirEntry;
  • Capabilities, typed failures and the semantic Errno;
  • strict codecs on internal/sandboxwire.
• The same package has the generic client and server:
  • The server runs requests concurrently up to a bound and handles CancelRequest itself.
  • When the transport is lost, the client fails in-flight requests with EffectPossible.
• apps/sandboxio/internal/fileservice is the Linux service:
  • an O_PATH|O_NOFOLLOW node table and a handle table;
  • *at lookups. Symlinks, including proc magic links, stay opaque: the service never follows one, and it reopens only descriptors it holds after checking their type;
  • node identity is (mount ID, dev, ino) with generation fencing, so bind aliases never merge;
  • atomic append and exclusive create;
  • renameat2 modes, probed at startup;
  • flock on the handle's own fd, which interoperates with native processes;
  • the errno table and incarnation checks.
  • POSIX record locks are not advertised.
• Spec amendments included:
  • Describe reports the service identity (uid/gid).
  • Export grants come from the Link binding: Attach needs a grant, and a read-only grant makes the attachment read-only.
  • Export isolation: the service serves the single export world. oac-sandbox-io roots it at /, and the Provider's sandbox setup owns the topology's isolation. There is no userspace containment probe.
  • RequestIDs strictly increase on a stream, using sandboxwire.RequestSequence.
• docs/file-access-protocol.md documents it, with an AGENTS.md boundary row and repository-map rows for internal/sandboxfs and apps/sandboxio.

Checks:

• go test -race on the protocol and service packages
• FuzzDecode, 30 s
• go vet on linux amd64, arm64 and 386; gofmt
• darwin and windows builds

Part of the agent-outside-sandbox work, milestone M1, lane L1a.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}