desktop: add the FUSE-T SMB, libfuse3, and WinFsp host adapters

[FSM1]

Scope

Three thin adapters behind the trait: FUSE-T >= 1.2.7 SMB backend (macOS, readdir single-pass quirk, SMB-backend invalidation), Linux kernel FUSE via the vendored fuser crate with the MSG_PEEK patch carried plus its committed regression test, and WinFsp (case-insensitive lookup, NTSTATUS mapping, notify API). Errno/status mapping per adapter; kernel entry/attr TTLs set from the sync timing profile per backend capability.
No FSKit adapter (designed-for, deliberately unbuilt), no macFUSE, no File Provider.

Blueprint anchors

blueprint/desktop.md: The FS core and host adapters; Backends; Freshness

Gate

Windows cargo check + adapter tests (PR tier, authoritative for the WinFsp adapter) + per-adapter errno/status mapping and MSG_PEEK regression tests in the fuse-op-core cargo job.

[FSM1]

Constraint carried over from #1110, PR #1156

Recorded 2026-08-07. #1110 landed the FUSE content write path, which stages writes in a per-handle sealed spill file. SpillArea has no production construction site today, because no HostAdapter implementation exists — that is this issue. When the adapter lands and constructs the spill area, one constraint is load-bearing and is not obvious from the call site.

Source the spill area's entropy from the production getrandom seam. The spill file uses XChaCha20-Poly1305 with counter nonces under a per-SpillFile random key. That construction is sound only because each key is fresh and unpredictable — a SpillFile never reuses a nonce under its own key, and two spill files never share a key. Wiring the spill area to a deterministic, seeded, or test entropy source in production would put a counter nonce under a predictable key, which is a nonce-reuse break rather than a weakened one.

The spill file names are also drawn from entropy, so that two spill areas over one directory cannot unlink each other's live spill.

Everything else about the spill is already fail-closed and needs nothing from this issue: files are created create_new(true) with mode 0o600, the sweep skips symlinks because DirEntry::file_type does not follow, a slot is claimed before its bytes land so a torn write fails closed instead of substituting base bytes, and the key is memory-only, zeroized and deleted with the handle.

Also verify on a real mount, since it cannot be exercised without one: that the adapter maps O_TRUNC to open-then-truncate, that close(2) surfaces the flush error, and that the spill behaves under the real 1 MiB framing block rather than the 16-byte block the tests use. The spill's close-before-unlink ordering is exercised only on the Windows CI leg.