sausage-vfs: layers (host, memory, generated, mounts), process guards, wasi:filesystem adapter

Checkpoint. More tests and the review findings follow.

vfs/src/readonly.rs

@@ -0,0 +1,30 @@
+//! Preserves read-only mount errors for mutations through open descriptors.
+use crate::*;
+pub(crate) struct Readonly(pub Arc<dyn File>);
+fn denied<T>() -> Result<T> {
+    Err(error(io::ErrorKind::ReadOnlyFilesystem))
+}
+#[async_trait]
+impl File for Readonly {
+    async fn stat(&self) -> Result<Stat> {
+        self.0.stat().await
+    }
+    async fn read(&self, offset: u64, length: usize) -> Result<Vec<u8>> {
+        self.0.read(offset, length).await
+    }
+    async fn write(&self, _: u64, _: Vec<u8>) -> Result<usize> {
+        denied()
+    }
+    async fn append(&self, _: Vec<u8>) -> Result<usize> {
+        denied()
+    }
+    async fn set_size(&self, _: u64) -> Result<()> {
+        denied()
+    }
+    async fn sync(&self) -> Result<()> {
+        self.0.sync().await
+    }
+    async fn set_times(&self, _: Option<SystemTime>, _: Option<SystemTime>) -> Result<()> {
+        denied()
+    }
+}