refactor: route config_seed and seed_manifest disk access through filesystem (sanitizing symptom 07) #3324

Situation

Sanitizing symptom 07 ("scattered disk access") is still the largest symptom. Gate 07 (npm run sanitizing:disk_access -- --base-ref origin/main, scripts/sanitizing_disk_access.mjs) measures disk_files = 151 on main 56a7d00e (after #3320).

Most remaining config/ files are reserved by other work (config.rs, archive_gate.rs, entity_creation*, replica_identity*, root_agent*, sessions_persistence*), belong to the settings-ownership epic #2992 (settings/, coding-agent catalog and profiles), or are touched by open PRs #3162/#3164 (agent_command*, agent_config*, local_config_io*, local_overlay.rs, teams*). Two related sub-trees are free: the config seed (copy of the seeded configuration into an instance) and the seed manifest (locked, handle-based manifest that records what was seeded). Their 6 counted production files still call std::fs directly (approximate list, read from the production body of each file):

• config/config_seed/copy.rs - metadata x2, remove_dir_all x2, read_dir x3, create_dir_all, copy x2, read, write x3; DirEntry and Windows MetadataExt in is_symlink_or_reparse.
• config/config_seed/perform.rs - rename x3, symlink_metadata x6, OpenOptions; Windows MetadataExt in metadata_is_reparse.
• config/seed_manifest/guard.rs - File (lock file, File::unlock), canonicalize, read_dir.
• config/seed_manifest/handles.rs - File, OpenOptions (Unix/Windows OpenOptionsExt, no-follow directory and file opens), symlink_metadata x4, Unix MetadataExt / Windows handle facts, is_windows_reparse.
• config/seed_manifest/publish.rs - File locking (TryLockError), remove_file x2, rename.
• config/seed_manifest/windows.rs - File, OpenOptions (Windows delete handle), File::from_raw_handle, rename.

Tree of symptom 07: these files are not container stores and are not filesystem; they read, copy, lock and atomically publish app data (seeded config, seed manifest) (R2), and several repeat link/reparse-point and no-follow checks that may already exist in filesystem (R1).

Precedents: #3259 (created src-tauri/src/filesystem.rs and its submodules), #3293, #3298, #3308 (PR #3314), #3320 (PR #3322).

Need

Rule 13 of the structure method: only container stores and the filesystem module touch the disk. These 6 files must stop calling std::fs directly; their disk work must go through filesystem as named business operations, or through the matching container store, which delegates physical operations to filesystem.

Intended change

1. Decide, through architecture review, where each disk operation of the 6 files goes (filesystem submodule(s) and/or existing container stores), and whether local safety checks are replaced by existing filesystem primitives.
2. Move the disk calls behind those owners; callers receive data or owned handles, not raw std::fs calls.
3. Versioned, consensus-approved plan with exact files and no open decisions (partitioned in phases if the size requires it; one branch, one PR).

Scope

In: the 6 production files above, src-tauri/src/filesystem.rs (only its sorted mod lines; shared reservation) and the filesystem submodule(s) the approved design requires, and their tests as needed. src-tauri/tests/c4_state_key_census.rs: only the inventory count literal (assert_eq!(sources.len(), 1395, "inventory count")), set to the verified real .rs count for the new files of the approved plan (shared reservation, same rule as #3320).

Out: every other config/ file, in particular config.rs, config/archive_gate.rs, config/entity_creation*, config/replica_identity*, config/root_agent*, config/sessions_persistence* (reserved by other work), config/settings*, config/coding_agents_catalog*, config/coding_agent_profiles* (#2992), config/agent_command*, config/agent_config*, config/local_config_io*, config/local_overlay.rs, config/teams* (touched by open PRs); the other config_seed/ and seed_manifest/ files that gate 07 does not count (config_seed.rs, seed_manifest.rs, lifecycle.rs, path_identity.rs, state.rs, wire.rs, tests*) unless the approved design needs a call-site change there; the seed manifest row validation of #1622; cli.rs; commands/, cli/, pty/, phone/, api/; filesystem/projects* (reserved by other work); the rest of src-tauri/tests/c4_state_key_census.rs; gates and scripts/containers.json unless the approved design requires a registry entry; tests' own std::fs use.

Must not change

Behavior byte for byte: same seeded files, contents and placeholder expansion, file names and locations, staging/trash/rename order and rollback, manifest wire format, lock acquisition and timeouts, error variants and texts, NotFound handling, paths (no new or removed canonicalization), no-follow opens, link/reparse-point and handle-identity protections, Windows delete-handle semantics, atomic replace semantics, and cfg. No wider public API. Any of these requires a user decision first.

Acceptance criteria

• Approved plan naming the owners and exact files.
• Gate 07 on the PR: disk_files drops by 6 (none of the 6 files counted) and no new file is counted; gates check:cycles and check:arcs PASS.
• cargo clippy --locked --manifest-path src-tauri/Cargo.toml --workspace --all-targets -- -D warnings clean, affected tests pass, CI (ci:full) green.
• No behavior change.