VFS: share the canonical rootfs overlay helper

[brandonpayton]

What remains

#907 already landed the recursive canonical /etc merge and the Chromium regression that proves browser test boots receive the OpenSSL files from rootfs.vfs.

This follow-up extracts the useful remainder from closed #909:

• the merge now lives in the shared host VFS layer instead of the browser app;
• existing caller-owned files, symlinks, and directory metadata still win;
• copied directories, files, and symlinks keep their source modes and owners;
• missing canonical /etc, short reads, and target-capacity failures stay visible;
• focused host tests cover preservation, metadata, ENOENT, short reads, and ENOSPC;
• the architecture doc now names the real test-runner and Git-test image assembly path.

The Node host still mounts its canonical rootfs directly. The browser test runner and Git test call the shared helper while building their small kernel-owned images.

Deliberately left out

I did not replay #907's OpenSSL/rootfs runtime fix, add a second overlay path, change kernel-worker behavior, or touch rootfs/package inputs. The browser app now delegates to the helper while keeping the behavior #907 landed.

ABI and packages

There is no ABI change. Package metadata, package revisions, binary indexes, VFS source inputs, and published artifact bytes are unchanged.

Validation

Run through scripts/dev-shell.sh:

• cd host && npm run typecheck
• cd host && npx vitest run test/vfs/rootfs-overlay.test.ts — 5 passed
• cd host && npx vitest run — 166 files passed; 1,360 tests passed; 2 expected failures; 42 skipped
• bash scripts/ci-check-browser-assets.sh — 92 imports resolved
• cd apps/browser-demos && KANDELO_PLAYWRIGHT_PORT=5493 npx playwright test test/openssl-rootfs.spec.ts --project=chromium — 1 passed
• cd apps/browser-demos && KANDELO_PLAYWRIGHT_PORT=5495 npx playwright test --grep-invert "@slow" --project=chromium — 51 passed; 4 skipped
• bash scripts/check-abi-version.sh
• git diff --check

I did not run a separate interactive ./run.sh browser session, Firefox/WebKit, libc/POSIX/Sortix suites, or performance benchmarks. This change does not alter guest syscall semantics, and it makes no performance claim.

Follow-up to #909.

[brandonpayton]

Closing this focused follow-up because its shared canonical rootfs overlay helper and strict preservation/error tests are now carried by #934 at exact green head 260d75d5adc31b327f5591229dbfbb287d395fd6. #934 keeps this as a separate purpose commit and passed the full staging and browser gates. This is not a claim that this branch was merged verbatim.