fix(fs): refuse to write through symlinks, make fstab validation mandatory [P0/P1]

Three defects from the follow-up audit, all in code that runs as root.

1. The fstab backup was an arbitrary-file-overwrite primitive.

   write_file_synced used fs::File::create, which follows symlinks. A symlink planted at
   /etc/fstab.awg2-harness.bak would be followed and its target truncated and overwritten
   with the contents of /etc/fstab. Same class of bug as the sidecar write in swap.rs,
   which the next commit removes entirely.

   New module atomic.rs owns the write path for every file this package installs under
   /etc and /var/lib: stat the destination with symlink_metadata, refuse anything that is
   not a regular file or absent, create a sibling temp with create_new so a symlink at the
   temp path cannot be followed either, write, sync_all, set the mode, rename, flush the
   directory. fstab.rs and managed_file.rs both use it, which also removes the two
   near-identical write_atomic implementations they each carried.

2. Directory fsync failures were swallowed.

   Both modules document crash-durable writes, then ignored the result of syncing the
   parent directory - the step that makes the rename survive a crash. sync_parent_dir now
   returns Result and callers propagate it.

3. findmnt validation was optional in practice.

   verify_candidate had `Err(_) => Ok(())`, so a host without util-linux silently skipped
   the only structural check on a file that decides whether the machine boots. The package
   already depends on util-linux, so this is now a hard error, and findmnt joins the
   required host tools when swap.enabled is true - failing preflight rather than at rewrite
   time.

   To keep the transaction testable off Linux, commit takes the validator through an
   injected fn pointer; production always passes the real findmnt check. That seam also
   made it possible to test the rejection path directly, which was previously unreachable
   in tests.

Also in this commit, since they are the same class of defect:

- fstab rollback used fs::copy straight onto /etc/fstab, which can leave it truncated if
  it fails midway. It now writes the original - held in memory since begin, so the
  recovery path does not depend on re-reading the backup - through the same atomic
  no-follow path as a forward write.
- the pristine .original copy is checked to be a regular file when it already exists; a
  symlink or directory there means the recovery copy cannot be trusted, so the commit
  refuses instead of proceeding.
- ManagedFile decided ownership with `first.contains(marker)`, so a file whose first line
  read "# NOT Managed by awg2-harness sysctl_tuning" was treated as ours and became
  eligible for overwrite and removal. Now an exact match on the trimmed first line.
- systemctl daemon-reload after a successful fstab commit, since /etc/fstab feeds
  systemd's generators and not only mount. Best-effort with a warning: the change is
  already committed and verified, and failing the operation over a missed notification
  would be worse than a stale generator state the next boot resolves.

Thirteen tests added: symlinked destination refused with the victim asserted intact,
symlink at the temp path not followed, directory destination refused, mode applied, stale
temp cleared, rejected candidate leaves the target untouched, non-regular pristine copy
refused, symlinked backup path refused with the victim intact, exact marker matching
against three near-miss first lines, and trailing whitespace tolerated on our own marker.

cargo test --workspace: 171 + 4 passed. clippy -D warnings clean.

traffic_core/src/config.rs

@@ -375,6 +375,11 @@ impl Config {
                 "swapoff",
                 "sysctl",
                 "dd",
+                // The candidate /etc/fstab is structurally validated with
+                // `findmnt --verify` before it replaces the live file. That check is
+                // mandatory, so its absence must fail preflight rather than be discovered
+                // at rewrite time.
+                "findmnt",
             ]);
         }
 
@@ -498,6 +503,7 @@ fn tool_exists(tool: &str) -> bool {
         "swapon" => &[&["--help"]],
         "swapoff" => &[&["--help"]],
         "sysctl" => &[&["--version"], &["--help"]],
+        "findmnt" => &[&["--version"]],
         "dd" => &[&["--help"]],
         _ => &[&["--version"], &["--help"], &["-V"]],
     };