feat(fast_io): fchmodat/fchownat/utimensat sandbox helpers (SEC-1.i)

[oferchen]

Summary

Extends the SEC-1 dirfd-anchored carrier with the metadata-application siblings:

• fchmodat(dirfd, name, mode, follow_symlinks)
• fchownat(dirfd, name, uid, gid, follow_symlinks)
• utimensat(dirfd, name, atime, mtime, follow_symlinks)
• fchmodat_via_sandbox_or_fallback / fchownat_via_sandbox_or_fallback / utimensat_via_sandbox_or_fallback adaptors that route a single-component leaf under the receiver's DirSandbox root through the *at variant while preserving the existing path-based fallback for multi-component paths, missing sandbox, and non-Unix targets.

Pattern source: SEC-1.g (#4671) unlink_via_sandbox_or_fallback.

Module layout

The new helpers live in a sibling at_syscalls_metadata.rs module rather than extending at_syscalls.rs directly. Reason: SEC-1.h (#4683) and this branch were both extending the same file in flight; landing them as parallel files avoids a merge-conflict re-spin and keeps each PR's diff focused. Once both have merged, the two modules may be re-folded into a single at_syscalls namespace as housekeeping.

Coordination with SEC-1.h (#4683)

SEC-1.h merged at 2026-05-21T17:47:51Z, while this branch was in flight. Both touch crates/fast_io/src/dir_sandbox/mod.rs (re-exports), but in different lines, so no textual conflict is expected. If the merge ordering surfaces any re-export collision, the fix is to consolidate both module declarations under one pub mod at_syscalls block as a follow-up housekeeping PR.

Receiver wiring

Deferred. The metadata-application call sites (metadata::apply_metadata_from_file_entry, apply_file_metadata_with_options, ...) live in the metadata crate, which does not depend on fast_io today. Threading DirSandbox through apply_metadata_from_file_entry requires:

1. Adding fast_io as a Unix-only dependency of metadata.
2. Adding apply_*_with_sandbox variants of the public entry points in metadata::apply that accept Option<&DirSandbox> and dest_dir: &Path.
3. Plumbing the sandbox through the transfer-side callers (crates/transfer/src/receiver/transfer/sync.rs, crates/transfer/src/receiver/directory/creation.rs, crates/transfer/src/receiver/quick_check.rs, crates/transfer/src/disk_commit/process.rs).

This is the same staging strategy used by SEC-1.b (which landed the carrier ahead of subsequent cutover PRs) and SEC-1.h (which deferred mknodat).

Cross-platform

• Linux + macOS: fchmodat / fchownat / utimensat are POSIX-2008 syscalls, present on every supported Unix target. The fallback path uses std::fs::set_permissions, raw libc::chown / libc::lchown, and filetime::set_file_times / set_symlink_file_times.
• Windows: the entire dir_sandbox module is #[cfg(unix)] (per the SEC-1.l audit, NTFS uses handle-based APIs that sidestep path TOCTOU). The new helpers inherit that gate; Windows builds compile this file out entirely.

Test plan

• CI fmt + clippy
• CI nextest (stable + Linux musl + macOS + Windows)
• Helper-level unit tests cover: raw *at success, ENOENT on missing leaf, AT_SYMLINK_NOFOLLOW preserves target inode under swap, sandbox fast path takes the *at route for single-component, fallback for multi-component, fallback when sandbox is absent
• Follow-up SEC-1.i.2 PR will wire receiver-side metadata application through the new helpers