harden the ephemeral-root salvage: clone, check space, lock

- clone each file with FICLONE, copy the data only where that fails
- skip the salvage when the copy would leave too little free space
- hold a per-container flock and one copy at a time across containers
- run WriteNspawnFlags on the blocking pool

nix/host-modules/hive-priv.nix

@@ -146,6 +146,10 @@ in
         ];
         # Writable HOME for nix's caches (see environment.HOME above).
         StateDirectory = "hive-priv";
+        # /run/hive-priv: the per-container salvage lock files. Root-owned and
+        # outside every path a container can write.
+        RuntimeDirectory = "hive-priv";
+        RuntimeDirectoryMode = "0700";
         # With ProtectSystem=strict the root filesystem is read-only inside
         # hive-priv. When `nixos-container create/update` invokes nix, nix
         # creates a temporary result symlink in its working directory. Without