harden the ephemeral-root salvage: clone, check space, lock

- clone each file with FICLONE, copy the data only where that fails
- skip the salvage when the copy would leave too little free space
- hold a per-container flock and one copy at a time across containers
- run WriteNspawnFlags on the blocking pool

hive-priv/Cargo.toml

@@ -11,6 +11,7 @@ workspace = true
 anyhow.workspace = true
 hive-priv-sock.workspace = true
 libc.workspace = true
+rustix.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
 tracing.workspace = true