atelet: serialize actor filesystem operations

[Yiqing Wang (YQ-Wang)]

Fixes #485

Summary

• reject overlapping lifecycle operations for the same actor at the atelet RPC boundary
• coordinate actor filesystem mutations across atelet and ateom with an advisory lock on their shared host path
• attach an operation ID to ateom requests so delayed or canceled stale requests cannot consume files prepared by a newer operation
• preserve compatibility with legacy atelet requests until a generation-aware operation has prepared the actor

Root cause

Atelet can return after its client context is canceled while ateom is still unwinding the server handler and cleaning actor files. An atelet-only mutex prevents simultaneous request handling, but it does not cover that cross-process cancellation window. The shared lock remains held by ateom until its handler exits, and the operation ID prevents a delayed request from running against a newer set of actor files.

Validation

• make verify
• go test -race -count=10 ./internal/actoroperation ./cmd/atelet ./cmd/ateom-gvisor ./cmd/ateom-microvm
• go test -race ./cmd/ateapi/internal/controlapi
• Linux ARM64 and AMD64 cross-builds for both ateom backends
• Kind ARM64 with fresh atelet and ateom-gvisor images:
  • successful Run -> Checkpoint -> Restore -> Checkpoint lifecycle
  • eight 96-way same-actor overlap waves: all 768 overlapping calls returned Aborted
  • immediate post-cancellation retries remained Aborted until ateom cleanup released the shared lock, then the first admitted retry reached the expected missing-worker Unavailable path
  • direct stale-generation and cross-process lock probes both returned Aborted
  • no directory not empty, unlinkat, lock-release, or panic errors in atelet or ateom logs