docs(design): plan re-fold of SEC-1 *at* helper modules post SEC-1.j ship

[oferchen]

Summary

• Adds docs/design/sec-1-at-syscalls-refold-2026-05-21.md capturing the SCHEDULED plan to re-fold crates/fast_io/src/dir_sandbox/at_syscalls{,_metadata,_rename}.rs into a single at_syscalls namespace now that all three SEC-1 at helper PRs (.h feat(fast_io): mkdirat/symlinkat/linkat sandbox helpers (SEC-1.h) #4683, .i feat(fast_io): fchmodat/fchownat/utimensat sandbox helpers (SEC-1.i) #4690, .j feat(fast_io): renameat sandbox helper (SEC-1.j) #4693) are on master.
• The 3-file split was a deliberate concurrency hack so SEC-1.h/.i/.j could land in parallel without rebase wars on a single file. Both .i and .j module headers explicitly schedule the re-fold; this doc turns those two paragraphs into a concrete plan (section dividers, use-line consolidation, sibling-file deletion, dir_sandbox/mod.rs re-export collapse).
• Includes an LoC sanity check: 1027 + 670 + 514 = ~2211 lines combined. The historical tools/enforce_limits.sh cap was removed on 2026-05-18, so no hard cap fires. The re-fold is recommended; the N/A path is documented as a contingency but not triggered.
• Documentation only. No code changes. The re-fold itself is a separate, behaviour-free refactor PR on branch refactor/fast-io-at-syscalls-refold.

Test plan

• Doc lints clean (no em-dashes, no AI-tool references, hyphens only).
• References every SEC-1 at PR by number and the source files by path.
• LoC math sourced from wc -l against origin/master.
• CI fmt+clippy pass (push-and-let-CI-verify).