Add opt-in Linux io_uring worktree writer

[russellromney]

Summary

Adds an opt-in Linux io_uring worktree writer while keeping POSIX as the portable default for macOS and normal Linux runs.

RIPCLONE_IO_URING behavior:

• unset or 0: POSIX writer
• 1: force the Linux io_uring writer
• auto: probe io_uring and fall back to POSIX if unavailable

The original high-level tokio-uring path has been replaced with raw io-uring batching. Each extractor writer thread now lazily owns a thread-local ring, so it preserves the existing extraction parallelism and avoids a cross-thread request/reply per file.

The current Linux fast path uses one linked chain per regular file:

• openat into a registered direct/fixed file slot
• fixed-file write, hard-linked to the open
• fixed-file close, hard-linked to the write

That keeps each batch in flight without first materializing normal file descriptors. Fly's kernel rejected direct openat while O_CLOEXEC was present, so the io_uring path strips that flag for direct opens. If a kernel still rejects direct descriptors with EINVAL/EOPNOTSUPP, the writer logs once and retries the batch with the normal-fd batched io_uring path.

The implementation keeps the existing path validation, symlink final-component protection, executable modes, deterministic mtimes, and portable POSIX fallback behavior.

Fly validation

Validated on the consolidated Fly setup from main:

• server: https://ripclone.fly.dev
• client app/image: ripclone-client-test
• client region: ewr
• benchmark machine: 8 shared CPUs, 2 GB, auto-stop/no restart
• target path: mounted ext4 Fly volume at /data
• repo: oven-sh/bun synced to 88417471cb28aab8943eb6227c014ac3f1c50cbc

Latest explicit /data comparison after direct descriptors started working:

• io_uring direct descriptors: extraction 542ms, bench write=755ms, total=2904ms
• POSIX comparison: extraction 573ms, bench write=722ms, total=2062ms

The write benchmark field is not a pure syscall/write timer; it covers working-tree extraction plus local blob pack work, and total time is noisier because resolve/fetch vary between runs. The direct-descriptor io_uring path is now functioning and is slightly faster in the extractor loop on this Fly volume run, but remaining cost is mixed with decompression, SHA-1 verification, mtime syscalls, and git skip-worktree cleanup.

Temporary benchmark volume vol_re1076l6w6y7mz14 was destroyed after testing. One-off machines exited with --rm; the standing 8-core app machines were stopped after validation.

Local validation

• rustfmt --edition 2024 src/worktree_writer.rs
• cargo check
• Linux Docker cargo check
• git diff --check

A generic rust:latest Docker image cannot link the focused worktree_writer test binary without the system libfuse package, so the post-direct-descriptor Linux validation used cargo check there.