allow erofs as the idmapped store filesystem

nspawn idmaps the store on erofs, which the VM test's store uses; the
allowlist from the store check refused it and failed the namespaced-agent
subtest in vm-nightly #7084. vm-nightly #7030 ran the same agent on the
same erofs store green. The magic is EROFS_SUPER_MAGIC_V1 from the
kernel's linux/magic.h; libc has no constant.

Refs #5888

docs/agent-lifecycle/persistence.md

@@ -488,13 +488,14 @@ hive-c0re can't read, or none, leaves the agent as it is.
   user. hive-priv mounts the agent's `state/`, `harness/`, `work/` and
   `claude/` dirs and its socket dir with `owneridmap`, and every other bind too
   (config, `/knowledge`, the runtime dir), whose owner shows as root inside.
-- **`/nix/store` has to be on ext4, btrfs or xfs.** nspawn mounts the store
-  into a namespaced container idmapped, and the kernel refuses that on
+- **`/nix/store` has to be on ext4, btrfs, xfs or erofs.** nspawn mounts the
+  store into a namespaced container idmapped, and the kernel refuses that on
   overlayfs and on some other filesystems. `WriteNspawnFlags` for an opted-in
   agent checks the `statfs` type of `/nix/store` against an allowlist of those
-  three. The check refuses every other filesystem, zfs and tmpfs included, even
-  where a newer kernel could idmap it, because the gate exists to stop a
-  container that would not boot. The error names the type and the fix, and
+  four; the VM test's erofs store idmaps on the hive's kernel. The check
+  refuses every other filesystem, zfs and tmpfs included, even where a newer
+  kernel could idmap it, because the gate exists to stop a container that would
+  not boot. The error names the type and the fix, and
   comes before anything moves. Check a host with
   `findmnt -no FSTYPE /nix/store`.
 - **The container starts with `--private-users=pick --private-users-ownership=map`.**