Add simulated filesystem and barriers for crash-consistency testing

[marcbowes]

Summary

Adds two related features behind unstable feature flags:

1. Simulated filesystem (unstable-fs) - Drop-in replacements for std::fs and tokio::fs with crash-consistency testing support
2. Barriers (unstable-barriers) - Observable synchronization points for testing (see Add barriers to turmoil #229)

Filesystem Usage

use turmoil::fs::shim::std::fs::{File, create_dir, write, sync_dir};

// Configure filesystem behavior
let mut sim = Builder::new()
    .fs()
        .sync_probability(0.1)  // 10% chance writes randomly sync
        .block_size(4096)       // Enable torn write simulation
    .build();

sim.client("db", async {
    create_dir("/data")?;
    write("/data/file.txt", b"hello")?;
    
    // POSIX durability: must sync both file AND directory
    File::open("/data/file.txt")?.sync_all()?;
    sync_dir("/data")?;  // Directory entry now durable
    
    Ok(())
});

// Simulate crash - unsynced data is lost
sim.crash("db");

Key Design Choices

POSIX durability model: File data and directory entries are tracked separately. sync_all() makes file data durable; sync_dir() makes directory entries durable. Both are required for a new file to survive a crash.

Torn writes: With block_size configured, pending writes may be partially applied on crash (0 to N blocks survive), simulating real disk behavior.

I/O latency + page cache (tokio shim only): Async operations can simulate realistic I/O timing with cache hits (~100ns) vs misses (configurable latency). O_DIRECT bypasses the cache. Sync operations (std::fs shim) complete immediately.

Worker thread support: FsHandle::current() captures context for use in spawn_blocking threads.

Limitations

• Permissions are informational only (not enforced)
• All paths must be absolute
• No file locking (flock/fcntl)
• I/O latency simulation only available for async (tokio::fs) operations

Test Coverage

86 tests covering durability, crash recovery, torn writes, symlinks, hard links, metadata, page cache, and worker threads.

[mcches]

#15 for tracking

[mcches]

Nothing is blocking. Thank you for this contribution.

[mcches]

Suggested change

	pub struct FsHandleGuard {
	_private: (),
	}
	pub struct FsHandleGuard;

[marcbowes]

Since this is pub, keeping the private field prevents external construction (users must go through FsHandle::enter()). This also preserves forward compatibility if we ever need to add state to the guard. Added a comment explaining this.

[mcches]

Do we need to keep this?

[marcbowes]

Removed - YAGNI.

[mcches]

These comments conflict.

[marcbowes]

Good catch - the comments were ambiguous. Updated to clarify the inode vs directory entry distinction: data in persisted_* survives crashes, but is only reachable if the path is also in synced_entries. Without a synced directory entry, the data is orphaned and cleaned up on crash.

[mcches]

Why bother with cfg here?

[marcbowes]

Good point - simplified. All branches had the same value because this is a simulation constant, not the real platform flag. macOS doesn't have O_DIRECT at all (uses fcntl F_NOCACHE), so we just use Linux's 0x4000 as the canonical value for portability.