test(dbfork): copy-on-write equivalence fixture via internal/fsclone

[barbatos2011]

What

Replace the dbfork equivalence gate's per-store byte copy with a copy-on-write clone, in a new reusable internal/fsclone package.

Why

TestEquivalence_GoVsJava materialises the 8 dbfork stores twice per run (scratchGo + scratchJava). Once the Nile snapshot is cached, that recursive copy is the dominant wall-clock cost — multi-GB on the RocksDB fixture. A copy-on-write clone shares the underlying extents, so each scratch copy is created in milliseconds at near-zero extra space; the first write to a block transparently splits it off, preserving the per-scratch independence the diff requires.

How

internal/fsclone.CloneDir(src, dst) (method, error) — build-tagged per platform:

• darwin: clonefile(2) via x/sys/unix.Clonefile — recursively clones a directory tree in one syscall.
• linux: walk + FICLONE per regular file (x/sys/unix.IoctlFileClone).
• other: byte-copy fallback.

Safety contract (a reusable primitive, not just a test helper):

• Stages into a temp dir it creates as a sibling of dst, then atomic rename into place.
• Refuses a pre-existing dst — never merges or clobbers.
• On failure removes only its own temp dir, never caller data.
• Falls back to a byte copy only on copy-on-write-unsupported errnos (EXDEV/EOPNOTSUPP/ENOTSUP/ENOTTY/EINVAL/ENOSYS); real errors (EPERM, ENOSPC, unreadable source) propagate instead of being silently masked as a slow copy.
• No manual copy_file_range layer — Go's io.Copy already uses it for *os.File on linux, so the fallback is kernel-accelerated where supported.

Equivalence test:

• Scratch dirs are now created adjacent to the fixture (same filesystem) instead of under t.TempDir(). t.TempDir() resolves under os.TempDir(), frequently a different filesystem than the cached fixture — so a clone across them returns EXDEV and silently degrades to a full copy, meaning the optimization would fire nowhere. Co-locating scratch with the fixture is what lets the clone actually reflink.
• Calls fsclone.CloneDir; the test-local cloneDir/copyDir/copyFile and their round-trip tests are deleted — there is now a single clone+copy implementation.

Tests

internal/fsclone covers: round-trip + independence; a seam that forces the byte-copy fallback deterministically on any host (so the fallback orchestration is tested even on CoW filesystems where the real clone always succeeds); real-error propagation; pre-existing-dst refusal; missing-source error; and the recursiveCopy fallback directly.

Verified: gofmt/vet clean, go build ./..., fsclone + dbfork unit tests pass, and cross-compile builds for linux amd64/arm64 (FICLONE path), darwin, and the windows fallback.

CI

dbfork-equivalence.yml gains a non-blocking copy-on-write probe that logs the fixture vs scratch device IDs and a cp --reflink=always result, so the run shows whether the clone actually reflinked on the runner or fell back to a copy. (GitHub's ext4 runners typically don't reflink — the win lands on copy-on-write filesystems; the probe makes that observable rather than guessed.)

Follow-up

TODOS.md captures a deferred public trond snapshot clone verb — left internal until a second real consumer (e.g. an agent warm-pool flow or apply --snapshot) exists.