harden the ephemeral-root salvage: clone, check space, lock

- clone each file with FICLONE, copy the data only where that fails
- skip the salvage when the copy would leave too little free space
- hold a per-container flock and one copy at a time across containers
- run WriteNspawnFlags on the blocking pool

hive-priv/src/main.rs

@@ -20,8 +20,9 @@
 //! dispatch table. Each op family's handlers and validation live in their
 //! own module: [`container`] (lifecycle), [`container_config`] (nspawn flags,
 //! systemd drop-ins), [`rootfs`] (the salvage of a container's root before it
-//! turns ephemeral), [`prestart`] (the check of a container's root that runs
-//! before each start, as a sub-command), [`storage`] (btrfs subvolumes, quotas, snapshots, disk
+//! turns ephemeral, with [`salvage_io`] for its space, reflink and lock calls),
+//! [`prestart`] (the check of a container's root that runs before each start,
+//! as a sub-command), [`storage`] (btrfs subvolumes, quotas, snapshots, disk
 //! measurement), [`files`] (pause marker, socket dir, legacy tmpfiles),
 //! [`infra`] (gateway nginx, infra containers) and [`closure`] (downloads from
 //! the swarm cache). Helpers more than one family uses are in [`shared`].
@@ -33,6 +34,7 @@ mod files;
 mod infra;
 mod prestart;
 mod rootfs;
+mod salvage_io;
 mod shared;
 mod storage;
 
@@ -383,18 +385,21 @@ async fn exec(
         PrivRequest::ListContainers => container::container_run(&["list"]).await,
 
         PrivRequest::WriteNspawnFlags {
-            ref container,
-            ref binds,
-            ref isolation,
-            ref load_credentials,
-            ref hive_facts,
-        } => container_config::handle_write_nspawn_flags(
             container,
             binds,
             isolation,
             load_credentials,
             hive_facts,
-        ),
+        } => {
+            container_config::handle_write_nspawn_flags_blocking(
+                container,
+                binds,
+                isolation,
+                load_credentials,
+                hive_facts,
+            )
+            .await
+        }
 
         PrivRequest::EnsureAgentSocketDir { ref name } => files::ensure_agent_socket_dir(name),