Add explicit save completion for sync volumes

[raphaeldelio]

Problem

An application can finish writing to an AFS sync mount while some files are still waiting to reach Redis. If its microVM stops then, the next session can restore an incomplete directory. AFS has no native command that confirms the entire included local tree has been saved. An empty event queue cannot establish this because uploads may still be running and watcher events may have been missed.

Solution

Add afs vol save [--timeout 2m] [--json] <volume|directory> for a mounted sync volume.

The daemon pauses background sync, lets active uploads finish, then saves and verifies the included local tree against Redis. It checks actual file bytes, paths, types, permissions and symlink targets, and rejects local changes during the operation. Success returns a receipt with entry and file counts, byte count, a tree SHA256 and completion time. Normal sync resumes with fresh workers.

Save reuses the local manifest verified after shutdown. Existing file operations and save share their request file transport; save retains its deadline, mount identity and receipt checks. Requests are polled independently of watcher events.

Callers must stop local and remote writers before saving. Conflicts, failed transfers, changing files and timeouts return errors. Failure can leave partial writes. Success confirms Redis visibility; it does not guarantee Redis disk persistence, an atomic snapshot under concurrent writes, or create a checkpoint.

The branch starts directly from main and requires neither #28 nor #29.

Validation

1. Full CLI race suite, command builds, go vet, Linux ARM64 save/control tests and all 26 POC harness tests passed. Regressions cover missed events, large files, conflicts, failures, deadlines, worker shutdown, legacy file operations and local edits after manifest capture.
2. The exact production binary passed real AWS AgentCore stress save and fresh restoration of all 1,752 files. Repeated saves also passed after large file creation, editing, truncation below the chunk threshold and expansion above it, including independently expected receipt hashes and full Redis byte checks.
3. A temporary instrumented build of the same source saved and restored a 6,444 file Python environment containing about 149 MB. All bytes and metadata matched; analytics and all 4,142 package RECORD hashes passed. The daemon was paused before auditing and the writer session was stopped before a fresh reader started.
4. That package save took 266.7 seconds using --timeout 10m: 169.3 seconds applying changes, 93.8 seconds reading back Redis, and 0.94 seconds across all four local scans. The default two minute timeout is insufficient for this workload. Profiling code is not included in the PR; these timings do not establish a speedup over the earlier run on a smaller Redis host.
5. A temporary checkout combining this implementation with unchanged Fix sync uploads for new and missing chunked files #28 and Recover sync after watcher overflow #29 passed the full CLI race suite. All cloud test sessions are stopped.