Pilot filesystem root confinement for Tiny File Manager

[karlg100]

Summary

• Add a filesystem-neutral root-confinement layer for active Tiny File Manager routes.
• Reject traversal, symlink escapes, and out-of-root access before filesystem operations.
• Support confined AFS device and mount transitions using Linux mountinfo detection.
• Add an isolated local-asset pilot profile and route-level regression coverage.

Relationship to other PRs

Includes the proxy work from #1432 and shares the early AFS rebase and hardening commits with #1433.

This is an alternate integration after the shared AFS base, not a descendant of the final provider/readiness commits in #1433. The two approaches modify the same request-routing and filesystem-wrapper seams and should not be merged together without an explicit reconciliation review.

Validation

• git diff --check
• PHP 7.4 syntax check for every PHP file
• AFS I/O audit: 81 checks, 0 unexpected failures
• AFS regression: 73 passed
• AFS static: 134 passed, 0 failed
• HTTP route confinement: 34 passed
• Pilot feature gates: 57 passed
• Filesystem confinement: 35 passed
• AFS multi-device confinement: 26 passed
• Root-confinement static checks: 55 passed

Draft boundary

All listed validation is offline and synthetic. Tested on private AFS cell.