Finalize filesystem error semantics

[novelKR]

Summary

• Map codespace-fs FsError 1:1 onto product codes: FILE_NOT_FOUND, PATH_NOT_DIRECTORY, FILE_OPERATION_FAILED, plus existing SYMLINK_REJECTED / SPECIAL_FILE_REJECTED. Runner owns a single fs_error_body translator (including find root canonicalize); rollback no longer sends filesystem I/O as INVALID_PATCH.
• PATH_ESCAPE is a workspace/path containment violation: a ../ or absolute request, or a find walk result outside workspace.root. FILE_OPERATION_FAILED means containment held and the operation itself failed.
• Bump WIRE_PROTOCOL 2 → 3 because ErrorBody product codes travel on that JSON. Handshake mismatch remains before-dispatch.
• Contract tests cover missing / ENOTDIR / escape / symlink / fifo / generic Io on runner, MCP read/find, and UDS. MCP fifo asserts SPECIAL_FILE_REJECTED only. Deleted-root find asserts FILE_OPERATION_FAILED on runner, UDS, and MCP. No new I/O, sandbox, or MCP tool names.

Reference note

• PR P0 filesystem: PathSandbox over isolated Codex LOCAL_FS #51 Linux chmod blocker and the O_NOFOLLOW + fchmod resolution/limitation: .github/notes/pr51-linux-chmod-blocker.md

Test plan

• cargo fmt
• cargo clippy --offline --all-targets -- -D warnings
• cargo test --offline -p codespace-runner (including find_on_deleted_root and UDS uds_find_on_deleted_root_is_file_operation_failed)
• cargo test --offline -p codespace-server --test read_find --test security (FIFO exact SPECIAL_FILE_REJECTED; MCP find on deleted root is FILE_OPERATION_FAILED)
• ./scripts/check-no-model-deps.sh
• python3 -B scripts/check_docs.py
• CI rust job on this draft (do not merge)