fix(posix): stop on-disk deletes and moves from resetting tree sizes to 0

[NickWalters]

Fixes #854. Part of opencloud-eu/opencloud#3109, together with #853.

Problem

On a posixfs storage with the watcher on, deleting or moving a folder directly on disk can reset the tree size of other folders to 0. The space usage drops with it. CheckQuota reads that same number, so a space with a quota then accepts uploads past its quota until OpenCloud restarts.

This affects setups where other tools write to the storage, which is the main reason to run posixfs. It needs nothing unusual, only STORAGE_USERS_POSIX_WATCH_FS.

I hit it on OpenCloud 8.1.0. I deleted a test folder in my personal space with rm -rf. A sibling folder with 52 GB in it dropped to a tree size of 0, and the space root went from 52 GB to 911 bytes. A restart put both back, because the startup scan walks everything.

How to reproduce

1. On a posixfs space with the watcher on, create two folders with a file in each.
2. Restart OpenCloud. The startup scan marks every folder as clean.
3. Delete one folder on disk with rm -rf.
4. The other folder now has a tree size of 0, and the space root has lost its size too.

Moving a folder on disk (mv a b) resets the moved folder to 0 in the same way.

Cause

With onlyDirty set, WarmupIDCache skips a clean folder, but it records a size of 0 for it first. After the walk, it writes that 0 as the folder's tree size and leaves the folder out of its parent's sum.

The watcher runs this walk on the parent after a folder is deleted on disk. A folder moved on disk is not marked dirty, so the walks that follow the move start at a clean root and reset that folder as well.

Fix

A clean folder now adds its stored tree size to its parents and keeps its own value. If a clean folder has no valid tree size, it is walked as before. A clean root writes nothing.

Only the onlyDirty walks that the watcher runs are affected. The startup scan and moves through the API pass onlyDirty=false, so they behave as before.

Tests

Five new specs. All of them fail on main and pass with this change:

• warmup_test.go calls WarmupIDCache directly: a clean folder next to a dirty one, a clean folder with an invalid tree size, and a clean root.
• tree_test.go goes through the watcher: it deletes a sibling of a clean folder, and it moves a clean folder on disk. Both specs run a full warmup first, because a folder is only clean after a walk has passed over it. The existing specs never reach that state, which is probably why this wasn't caught before.

go test -race ./pkg/storage/fs/posix/... passes locally (the tree package five times in a row), and golangci-lint is clean on the package.

Notes

• fix(posix): move the tree size along with items moved on disk #853 is built on this PR. Please merge this one first.
• fix(posix): re-assimilate moved and changed files during a scan #808 changes the same part of WarmupIDCache, so whichever of the two merges second needs a small rebase. Both sides only add lines. I merged them together and the tests pass. I'm happy to rebase this one.

[NickWalters]

Hi @aduffeck, could you approve the CI run for this one? It fixes tree sizes, and with them quota checks, dropping to 0 after a folder is deleted or moved on disk. I hit it on 8.1.0.

Could you also add the Type:Bug label so it shows up in the release notes? #796 and #797 were merged without a label, and neither is listed in the v2.51.0 notes.