Serve the Session world to views over the File protocol

[SaladDay]

Lane L1b of the agent-outside-sandbox workstream. A Session view sees the sandbox's world export as its filesystem. worldfs serves that filesystem with FUSE, and each kernel request becomes at most one File protocol request.

Changes

• apps/daemon/internal/worldfs: a go-fuse v2 raw-API frontend (Linux; other platforms get a stub that returns ErrUnsupported).
  • Mapping and caching: doc.go holds the mapping table. The profile is uncached: zero TTLs and FOPEN_DIRECT_IO, with only the declared capabilities negotiated.
  • Errors and identity: one errno table, where stale nodes and handles give ESTALE. The service uid/gid is shown as the view uid/gid and mapped back on SetAttr.
  • Presentation:
    • Mountpoints and their missing ancestors are synthetic and immutable.
    • Entries on the way to a mountpoint are pinned with stable node IDs.
    • Sandbox symlinks are followed with Walk/Readlink, at most 40 hops.
    • A changed pinned entry reports ErrTopologyChanged.
  • Link loss: it redials and continues only when ServerInstanceID is unchanged. A request is re-sent only if it was never sent; a new incarnation or an ended attachment marks the world lost.
  • Cleanup: Release, ReleaseDir and Forget that were never sent, or were refused with ResourceExhausted/EffectNone, are queued. They retry after the next redial or after a bounded backoff (20 ms to 2 s), and a request that may have reached the service is never re-sent.
  • Locks: the lock requests of one owner on one handle take turns, so a failed non-blocking conversion's recovery unlock cannot remove a lock that someone else acquired.
    • A SETLKW gives up its turn while it waits.
    • Waiting for a turn or for the connection can be interrupted, which returns EINTR with nothing sent.
    • Unsafe or failed recovery returns EIO.
  • Uncertain Attach: if Attach may have taken effect without an answer, or the stream was redialled during presentation, or Start's context ends, or Detach fails, then Serve fails with ErrAttachmentDirty. The owner of the Link attachment (the agent host, L5a) then ends that attachment.
  • Stop: waits for serving to end, drains pending Forgets, then Detaches. A world whose Serve failed or never ran stops at once.
• sessionview:
  • World takes Start's context and returns (WorldServer, Presentation, error), and WorldMount carries the view UID/GID. A Start cancelled during construction keeps the World's error (for example ErrAttachmentDirty).
  • The privileged gateway view test sets the StagingParent that Declare agent-host Session views in the Runtime–Harness protocol #350 made required.
  • The launcher mounts at the resolved targets, still with RESOLVE_NO_SYMLINKS.
  • View.Presentation() is added.
• apps/sandboxio/fileservicetest: a fixture that serves the file service over a temp dir through net.Pipe, with Break(), Restart() and an Intercept hook for deterministic tests.

Declared gaps:

• POSIX fcntl locks return ENOLCK; the service declares only flock.
• Link and Symlink return EPERM when undeclared.
• Mknod returns EOPNOTSUPP.
• Fallocate is out of phase 1.

Two defects need the File protocol change in L1c, which also moves this frontend onto it:

• fcntl(F_SETFL) toggling O_APPEND on an open file is ignored, because append is fixed at Open;
• a handle whose Open reply is lost stays until Detach.

L1c gives per-write append, client-chosen handle IDs and a fence on stream succession. M1 qualification waits for it.

Checks

• Gofmt and vet; unit tests on worldfs, sessionview and the sandboxio packages.
• Darwin and windows builds.
• Privileged container (OAC_TEST_WORLDFS=1): PASS, five runs.
  • It covers the go-fuse posixtest suite (skipping Fallocate and fcntl locks) and owner mapping.
  • It covers presentation (/bin -> usr/bin, the shim at /usr/bin/sh), symlink loops, topology changes, instance changes, and a real launcher view editing the workspace.
• A race build: three runs.
• Review rounds: two blind-review rounds and a focused review of the fixes. Each fix has a regression test that fails without it:
  • TestLockRecoveryKeepsLaterLock;
  • TestRefusedReleaseIsRetried;
  • TestReleaseQueuedAfterRedial;
  • TestServeEndsWithItsContext;
  • TestLockInterruptedWhileRedialing;
  • TestStartEndsDuringAttach;
  • TestUnsentLockInterruptedBehindTurn;
  • TestRefusalAfterOwnRedialWaits;
  • TestUnsafeLockRecoveryFails.
• After the final rebase: in the privileged container, worldfs (19), sessionview (6) and gateway (11) pass.