Add fail-closed AFS data-plane support

[karlg100]

Summary

• Rebase the AFS integration onto current upstream Tiny File Manager.
• Route AFS reads, writes, metadata, ACLs, search, download, and mutation operations through a provider contract.
• Add fail-closed production-profile, local-asset, CSP, URL-upload, archive, direct-link, and readiness gates.
• Add route-by-route audits, regression coverage, readiness checks, and a separate live AFS validation plan.

Relationship to other PRs

Depends on #1432 for the first proxy-support commit. Once #1432 merges, GitHub should reduce this diff to the AFS-specific commits.

This provider-based integration and the root-confinement pilot are alternate implementations at several filesystem-wrapper seams. They must be reconciled before both can merge.

Validation

• git diff --check
• PHP 7.4 syntax check for every PHP file
• AFS I/O audit: 165 assertions, 0 failures
• Readiness: 306 passed, 0 failed
• Regression: 137 passed
• Static contract: 564 passed, 0 failed

Draft boundary

Offline source and contract checks pass. Tested on private cell.