feat(fs): add generic filesystem namespaces

[chaliy]

What changed

Add NamespaceFs, a generic static filesystem namespace that composes arbitrary FileSystem subtrees behind visible targets. The builder supports source-root rebasing, per-mount read-only/read-write access, deterministic nested precedence, synthetic ancestors, consistent metadata/listing behavior, safe cross-mount copy, and typed cross-device rename rejection.

Includes runnable generic sandbox and rebasing examples, Rustdoc guide/API examples, public filesystem docs, VFS specification updates, and TM-ESC-031 threat-model coverage.

Why

Embedders need one bounded filesystem tree assembled from independent sources for build sandboxes, tests, plugin hosts, serverless functions, CI, and shell sessions without introducing agent-specific paths or lifecycle abstractions.

Before / After

Before: MountableFs could mount only source roots, exposed a fallback root tree, and emulated cross-mount rename with non-atomic copy-delete.

After, verified by smoke runs:

$ cargo run -p bashkit --example namespace_sandbox --no-default-features
fn main() {}
build, cache, and tmp are writable; src is read-only

$ cargo run -p bashkit --example namespace_rebase --no-default-features
pub fn answer() -> u8 { 42 }
nested writable override created schema.rs

Behavioral/security coverage: 11 namespace tests pass, including rebasing, synthetic mount listing, metadata parity, normalization, TM-ESC-031 traversal/read-only bypass resistance, same- and cross-mount operations, and symlink preservation.

Risk

• Medium: new public VFS composition API and path-routing logic.
• Existing filesystem implementations and MountableFs behavior are unchanged.
• Cross-mount rename deliberately returns ErrorKind::CrossesDevices; directory/FIFO cross-mount copy returns ErrorKind::Unsupported.

Validation

• just pre-pr
• just test
• cargo bench -p bashkit --bench parallel_execution --no-default-features
• both new examples smoke-run
• Rustdoc examples compile

Checklist

• Tests added or updated
• Backward compatibility considered

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	1157d56	Commit Preview URL Branch Preview URL	Jul 17 2026, 03:30 AM