harden the ephemeral-root salvage: clone, check space, lock

- clone each file with FICLONE, copy the data only where that fails
- skip the salvage when the copy would leave too little free space
- hold a per-container flock and one copy at a time across containers
- run WriteNspawnFlags on the blocking pool

Cargo.lock

@@ -1990,6 +1990,7 @@ dependencies = [
  "anyhow",
  "hive-priv-sock",
  "libc",
+ "rustix",
  "serde_json",
  "tokio",
  "tracing",