fix(deps): Adapt code to fuser 0.17 breaking changes

fuser 0.17 requires Filesystem: Send + Sync + 'static, which means
the composefs core types need to be thread-safe. This commit:

- Changes Rc<Leaf<T>> to Arc<Leaf<T>> and Box<Directory<T>> to
  Arc<Directory<T>> in the generic_tree Inode enum, making tree nodes
  shareable across threads.

- Changes RefCell<BTreeMap<...>> to RwLock<BTreeMap<...>> in Stat.xattrs,
  replacing .borrow()/.borrow_mut() with .read().unwrap()/.write().unwrap().

- Rewrites composefs-fuse to adapt to fuser 0.17's API changes:
  - &mut self -> &self on all Filesystem trait methods (mutable state
    moved behind a Mutex)
  - u64 -> INodeNo/FileHandle/LockOwner newtype wrappers
  - i32 -> OpenFlags, reply errors use fuser::Errno constants
  - Session::run() replaced with Session::spawn()?.join()
  - Session::from_fd() takes a Config parameter
  - serve_tree_fuse() now takes Arc<Directory> and Arc<Repository>
    by value to satisfy the 'static bound
  - #![forbid(unsafe_code)] is preserved throughout

Assisted-by: OpenCode (claude-opus-4-6)

Author: jeckersb

crates/composefs-boot/src/selabel.rs

@@ -211,7 +211,7 @@ impl Policy {
 }
 
 fn relabel(stat: &Stat, path: &Path, ifmt: u8, policy: &mut Policy) {
-    let mut xattrs = stat.xattrs.borrow_mut();
+    let mut xattrs = stat.xattrs.write().unwrap();
     let key = OsStr::new(XATTR_SECURITY_SELINUX);
 
     if let Some(label) = policy.lookup(path.as_os_str(), ifmt) {
@@ -268,7 +268,8 @@ fn parse_config(file: impl Read) -> Result<Option<String>> {
 fn strip_selinux_labels<H: FsVerityHashValue>(fs: &FileSystem<H>) {
     fs.for_each_stat(|stat| {
         stat.xattrs
-            .borrow_mut()
+            .write()
+            .unwrap()
             .remove(OsStr::new(XATTR_SECURITY_SELINUX));
     });
 }