feat(fast_io): add openat_via_sandbox_or_fallback + readlinkat_via_sandbox helpers (closes 16+ SEC-1 GAPs)

[oferchen]

Summary

Adds two new SEC-1 helper families to fast_io::dir_sandbox::at_syscalls:

• openat + openat_via_sandbox_or_fallback -- single-shot opens
  anchored on the sandbox dirfd, with a best-effort O_* translation
  to std::fs::OpenOptions on the fallback path.
• readlinkat + readlinkat_via_sandbox_or_fallback -- symlink
  target reads anchored on the sandbox dirfd, falling back to
  std::fs::read_link outside the sandbox fast path.

Follows the established SEC-1 pattern (raw helper + adaptor +
single_component_leaf eligibility check) used by unlinkat,
mkdirat, renameat, etc.

This PR only adds the helpers and their re-exports through
dir_sandbox::mod and fast_io::lib. It deliberately does not
wire any of the 16+ identified call sites -- per-site wiring lands in
follow-up PRs so each cutover gets its own diff and review.

Extends the existing tests module with 10 new tests (3 raw openat /
openat sandbox, 4 openat_via_sandbox sandbox/multi-component/no-sandbox,
3 raw readlinkat / sandbox / multi-component fallback).

All helpers are #[cfg(unix)] (the dir_sandbox module is itself
Unix-only); Windows continues to use path-based stdlib opens per the
SEC-1.l NTFS handle audit. No Windows unused-import risk.

GAPs closed (post-wire) from PR #4710 audit

Per the GAP table in docs/audits/sec-1-path-syscall-audit-2026-05-22.md,
the new helpers unblock the following sites once their respective
follow-up wiring PRs land:

GAP #	File / line	Syscall now covered
4	transfer/receiver/directory/links.rs:75	read_link -> readlinkat_via_sandbox_or_fallback
9	transfer/receiver/quick_check.rs:268	File::open -> openat_via_sandbox_or_fallback
10	transfer/receiver/basis.rs:119	File::open -> openat_via_sandbox_or_fallback
11	transfer/receiver/basis.rs:134	File::open -> openat_via_sandbox_or_fallback
12	transfer/transfer_ops/response.rs:80	OpenOptions::open -> openat_via_sandbox_or_fallback
13	transfer/transfer_ops/response.rs:342	OpenOptions::open -> openat_via_sandbox_or_fallback
14	transfer/disk_commit/process.rs:232	OpenOptions::open -> openat_via_sandbox_or_fallback (also needs SEC-1.j cross-thread plumbing)
15	transfer/disk_commit/process.rs:236	OpenOptions::open -> openat_via_sandbox_or_fallback (same plumbing)
16	transfer/disk_commit/process.rs:354	OpenOptions::open -> openat_via_sandbox_or_fallback (same plumbing)
17	transfer/temp_guard.rs:130	OpenOptions::create_new -> openat_via_sandbox_or_fallback
19	transfer/temp_guard.rs:217	remove_file Drop -- benefits from open carrier rework
20	transfer/temp_cleanup.rs:95	read_dir -- needs follow-up openat + fdopendir helper built on top of these
21	transfer/temp_cleanup.rs:137	remove_file -- benefits from open carrier plumbing
5	transfer/receiver/directory/deletion.rs:115	read_dir -- ditto
6	transfer/receiver/directory/deletion.rs:157	remove_dir_all -- recursive *at peel built on openat + readdir + unlinkat
27	engine/delete/emitter/fs.rs:90	remove_dir_all recursive fallback -- same recursive peel

That is 16 direct beneficiaries; the broader follow-up set
(open_path-based code paths reachable through the disk_commit and
temp-file lifecycle clusters) brings the count past 20 once the
DeleteFs trait refactor lands (tracked separately, out of scope here).

Test plan

• CI fmt + clippy + nextest (stable + Linux musl + macOS + Windows)
• No callers wired -- behaviour for existing sites is unchanged.
• 10 new tests in crates/fast_io/src/dir_sandbox/at_syscalls.rs
  tests module exercise sandbox fast path, multi-component
  fallback, absent-sandbox fallback, and ENOENT/EINVAL error paths.