fix(posix): write the fs-revisions copy from the stored file

[Mortimer-RR]

Fixes #840

Changes

• pkg/storage/fs/posix/tree/revisions.go RestoreRevision: copies the revision into a
  temp file in the space's .oc-tmp directory, fsyncs it, carries over the target's
  user.oc.* xattrs, mode and owner (a failed chown is logged, not fatal), applies the
  revision's checksum, blob id, blob size and type attributes and the mtime, and
  rename()s it over the target, like blobstore.Upload does for uploads. The mtime is then
  set through the metadata backend so its cache picks up the new attributes. The "current"
  copy for EnableFSRevisions is unchanged.
• pkg/storage/pkg/decomposedfs/upload/upload.go Cleanup (versionID branch): takes the
  node's metadata lock and re-reads the status through the metadata backend (bypassing the
  node's attribute cache). It only restores when the node is still processing:<this session>. Otherwise it logs, keeps the node, and leaves the revision as an ordinary
  version. The lock is released before the rest of Cleanup, whose UnmarkProcessing
  locks again through a different node object.

Tests

• pkg/storage/fs/posix/tree/revisions_test.go:
  • restore keeps the node metadata and applies the revision's blob metadata;
  • a failed copy leaves the target untouched (fails on main: target truncated to 0 bytes);
  • concurrent readers only ever see the old or the new content (fails on main: 3831 of
    3841 reads saw partial content).
• pkg/storage/pkg/decomposedfs/upload_async_test.go, "two uploads overwrite an existing
  file in parallel": the older upload fails after the newer one succeeded; the newer content
  and the original version must survive (fails on main: the file is rolled back from 20
  to 10 bytes).
• go test -race clean on pkg/storage/fs/posix/tree, pkg/storage/pkg/decomposedfs and
  its upload package. pkg/storage/... passes.
• End to end (OpenCloud, posix): restores under load with 10 readers had 0 bad downloads
  (upstream: 50 of 50 bad); aborting the older upload keeps the newer content (upstream:
  rolled back).

Note: downloads still don't take the node lock; with the atomic rename they don't need it
for consistent bytes (an open file descriptor keeps the old inode).

🤖 Generated with Claude Code