Guest processes cannot read or write host_dir mounts in 0.2.14 (breaks agentos-apps deployApp)

[tobowers]

Every guest-side access to a createHostDirBackend mount fails with
Permission denied (os error 2) in 0.2.14 — writes and reads, new and
existing files. The host-side VM API (vm.readFile/vm.writeFile) works
correctly through the same mount, so the guest-syscall path for the native
host_dir plugin looks like the broken layer.

Reproduced identically on macOS 15 arm64 and Linux arm64
(node:22-bookworm-slim), Node 22.23.

Minimal reproduction (one script, pinned to 0.2.14, Dockerfile included for
the Linux run): https://github.com/tobowers/agentos-hostdir-repro

npm install && npm run repro

Output excerpt:

[PASS] guest fs write (control)
  $ sh -c echo ok > /work/control.txt
  exit=0

[FAIL] guest write NEW file into mount
  $ sh -c echo from-guest > /mnt/new.txt
  exit=1 error: failed to redirect to /mnt/new.txt: Permission denied (os error 2)

[FAIL] guest overwrite EXISTING file in mount
  $ sh -c echo overwrite > /mnt/existing.txt
  exit=1 error: failed to redirect to /mnt/existing.txt: Permission denied (os error 2)

[FAIL] guest tar -cf INTO mount (agentos-apps pack step)
  $ tar -cf /mnt/out.tar .
  exit=1 tar: Permission denied (os error 2)

[FAIL] guest tar reading FROM mount
  $ tar -cf /work/probe.tar -C /mnt .
  exit=1 tar: Permission denied (os error 2)

Host-side API through the same mount:
  vm.readFile(/mnt/existing.txt): "seed from host\n"
  vm.writeFile(/mnt/host-api.txt): ok

Impact: @rivet-dev/agentos-apps is fully broken — deployApp()'s pack
step runs guest tar -cf into a host-dir mount, so every deploy fails with
agentos_apps_pack_failed:

RivetError: tar failed with exit code 1
metadata: { exitCode: 1, stderr: "tar: Permission denied (os error 2)\n" }

We are currently working around it by patching the pack step to write the
artifact to the guest filesystem and read it back over the host API (which
works).

Two observations that may help triage:

• Not a symlinked-tmpdir/confinement-walk issue: it reproduces with the host
  directory under a symlink-free path (/Users/...) as well as macOS
  $TMPDIR and Linux /tmp.
• packages/core/tests/host-dir-backend.nightly.test.ts exercises guest
  reads of host-dir mounts but appears to be nightly-only, which may be how
  this shipped in a release.