feat(op): make the session own filesystem access behind accessors - #414

Phase 2b, PR 2b.2b of the native-Windows-permissions plan (#405),
completing 2b.2 after #413 put CreateTemp/MkdirTemp on the interface.
RuntimeEnvironment.Root is no longer a field anyone can set or read
directly: the session owns filesystem access and hands it out.

HasRoot() answers from the spec's anchor rather than from whether a
handle has been minted, so its answer cannot change mid-session. Root()
panics when HasRoot() is false -- a rootless session is legal and
advertised (cmd/lore builds one in production), so the panic reports a
caller that never asked rather than an impossible state. Returning a
bare nil was rejected during design: fsroot.Root is an interface, so nil
does not avoid the panic, it relocates it into fsroot with a stack that
never names the mistake. Modeled on reflect.Value.IsValid, whose doc
states the rule once and whose getters panic.

Scratch() returns a per-session private directory INSIDE the OS temp
directory -- never a root over the temp directory itself, which is
shared with every process, cannot be mode-controlled, and could not be
removed on Close. It is created 0700, so phase 2 gives it a protected
DACL on Windows, which matters because scratch holds the most sensitive
transient data in the system. There is no HasScratch: nothing about
scratch is configurable, so the predicate could only ever return true.

Both anchors are PREFLIGHTED at construction and released again --
probeRootAnchor opens and closes the root, probeScratchAnchor creates
and removes a temporary directory. That is what licenses both accessors
to assert: validation has already passed, so a later failure is an
invariant violation, matching the repository's checksum trust boundary.
Allocation stays lazy behind a sync.Once each, because gather dispatches
bodies concurrently and two goroutines can reach an accessor at once. A
planning-only session holds no handle and closes nothing.

105 sites across 25 files moved, and the seven that nil-checked the
field became HasRoot() guards. The 82-site estimate counted production
only and was accurate there; test files added the rest.

The mechanical rewrite over-matched once and the compiler caught it:
triad_test.go has a local triadEnv fixture with its own Root field, so
env.Root there is not the session. Twenty rewrites reverted. It failed
loudly only because a field is not callable -- an interface with a
Root() method would have compiled and silently changed meaning, which is
the risk phase 6's rename runs over a much larger surface.

One existing test specified the old contract (Root() != nil on a
rootless session) and now specifies the new one, with recover() proving
the panic. A new test pins scratch: private tree inside os.TempDir, same
instance on every call, 0700, removed on Close.

Verified: make test zero failures; make lint-all zero issues on linux,
darwin, and windows.

Assisted-by: Claude
Signed-off-by: David Noble <[email protected]>