fix(storage): allow mounted files beyond the callback payload limit - #1879

Linked Issue

Closes #1878

Summary

Fix mounted writes and resizing beyond 4 MiB. The shared kernel callback had applied the per-request payload ceiling to the resulting whole-file length, making a real FSKit fsync fail with EINVAL at 4 MiB+1 byte.

Changes

• Keep the 4 MiB request bound; validate file lengths against the signed native offset domain instead.
• Stream old ranges, replacement bytes and zero-filled gaps into atomic content publication instead of allocating a whole-file buffer.
• Expose streaming publication through owner, subtree and workspace adapters. Workspace publication retains branch quota checks and bounded staging when a quota is configured.
• Cover large writes, overwrites, extension, truncation, source failures and quota refusal.
• Bound newly materialized gap bytes to the existing 4 MiB callback budget. Oversized resize/write gaps fail before publication; ordinary contiguous growth is not capped at 4 MiB. Sparse extensions remain unsupported.

Verification

• cargo test --locked -p astrid-kernel --lib storage_mount -- --test-threads=1: 24 PASS (original candidate).
• cargo test --locked -p astrid-storage --lib content::store::workspace -- --test-threads=1: 24 PASS.
• cargo clippy --locked -p astrid-kernel -p astrid-storage --all-targets -- -D warnings: PASS.
• cargo fmt --all --check and git diff --check: PASS.
• Real macOS 26.6.2 FSKit mount, local development-signed app build 664 and optimized candidate daemon: three 32 MiB write/fsync/SHA256-read samples completed. Previously the first sample failed EINVAL.
• Separate actual-mount regression: 8 MiB+ write, overwrite crossing 4 MiB, zero-filled extension and gap, shrink above 4 MiB, sync, unmount/remount, SHA256 readback, truncate to zero: PASS.

Claim limits: this is correctness, not a random-write performance optimization. Replacement still rebuilds the content graph; workspace deferred records remain retained until publication. On the final 9661cba source build, mounted 32 MiB fsync took 3.63–3.93 seconds locally; all three samples and the remount regression passed. Warm OS-cache reads are not backend throughput. Linux/Windows use the shared kernel adapter, but this PR does not claim a new packaged native execution on those hosts.

Latest repair verification: cargo test -p astrid-kernel storage_mount --lib -- --quiet: 25 PASS; focused range tests: 2 PASS; cargo clippy -p astrid-kernel --lib --tests -- -D warnings, formatting and diff checks PASS. The new regression rejects both SetLength and Write gaps beyond budget, including i64::MAX, with original bytes unchanged. Exact-budget extension and shrinking remain valid. Earlier mounted measurements are retained as earlier-candidate evidence, not a rerun of this repair. CI workflow repair #1891 is included as a prerequisite until it lands.

Test Plan

Run the commands above. On an admitted writable mount, write more than 4 MiB, fsync, patch across the boundary, extend/shrink, sync and remount, then compare complete file bytes. Verify an oversized individual RPC is still rejected and a quota/source failure preserves the prior file.

AI / Tool Assistance

Assisted-by: Codex:GPT-6-Astra

Implemented and reviewed the adapter changes, source/publication ordering, integer bounds, quota preservation and regression coverage; exercised the real FSKit mount in a disposable AOS home.

Checklist

• Linked to an issue
• Changelog fragment added under changes/1878.fixed.md
• I understand every change in this PR and can explain its design, risks, and validation.
• I reviewed and tested any meaningful tool-generated output included in this PR.
• Every non-bot, non-merge commit has a matching Signed-off-by trailer.