[codex] refactor VFS into reusable crates and backends

[NathanFlurry]

Summary

• Move the reusable POSIX filesystem and generic storage engines into crates/vfs, including overlay/root/mount-table code, chunked/object engines, metadata/block/object traits, cache, in-memory stores, and conformance tests.
• Add crates/secure-exec-vfs for secure-exec-specific backends: SQLite metadata, local file blocks, S3 block/object storage, and callback metadata over the sidecar bridge.
• Rework sidecar mount plugins around the new engine/backend split: object_s3, chunked_s3, and chunked_local; remove the legacy manifest-backed s3 and sqlite_vfs plugins.
• Update TS descriptor helpers, @secure-exec/s3, architecture docs, and compatibility fixes uncovered by the refactor.

Impact

S3 mounts now use either native object-key layout (object_s3) or chunk blocks plus metadata (chunked_s3) instead of a tree-wide JSON manifest. Local durable roots can use the same managed chunked filesystem via chunked_local. Future Rivet actor integration can plug into chunked_s3 through the callback metadata backend without reimplementing the filesystem data plane.

The wire/config shape remains the generic mount plugin descriptor (id + JSON config); the API change is the explicit plugin IDs and config helper surface.

Validation

• cargo fmt --all
• cargo build --workspace
• cargo clippy --workspace --all-targets
• cargo test --workspace
• cargo doc -p vfs --no-deps
• make -C registry/native wasm
• corepack pnpm --dir packages/core check-types
• corepack pnpm --dir registry/file-system/s3 check-types
• corepack pnpm --dir registry/file-system/s3 test

Stale-reference audits also passed for old VFS crate names, deleted old paths, forbidden crates/vfs deps, and CLAUDE.md/AGENTS.md symlink convention.

[railway-app]

🚅 Environment secure-exec-pr-102 in rivet-frontend has no services deployed.