Hand hull the workspace as a directory descriptor, not a path

[pmoust]

Problem

brig hands the workspace to hull as a path string (internal/runtime/hull.go,
the --shared-dir host:guest loop). hull resolves that string in its own
process, after the manifest resolution, the pull and the VM start. Anything
that can write a parent component of the path can change what it names in that
window, and the workspace is mounted read-write as the guest's home.

verifyStillOurs (internal/wrap/run.go, just before the share is built)
narrows the window to the moment brig checks, and its comment says so. It
cannot close it: the resolution that decides which directory the guest gets is
hull's.

What hull offers now

hull v0.1.0-rc24 (brig-sh/hull#13, closes brig-sh/hull#7) accepts
--shared-dir-fd FD:/guest/path[:ro|rw]. The caller opens the directory and
passes the descriptor across the exec. hull fstats it and names the share as
volfs /.vol/<device>/<inode>, which has no renameable component, so the
guest gets the directory the caller held open however the path changes in
between. This is macOS only; on Linux hull still takes a path.

hull#13 says brig can drop verifyStillOurs once it uses the flag.

Proposed change

1. After openWorkspace, open the workspace directory as an *os.File
   through the root brig already holds (os.Root has no descriptor accessor,
   so root.OpenFile(".", O_RDONLY|O_DIRECTORY|O_NOFOLLOW, 0)), and check
   it is the same inode as workspaceRoot.ident.
2. When the runtime is hull and it understands --shared-dir-fd, put the
   file in cmd.ExtraFiles and pass --shared-dir-fd 3:/home/...[:ro]
   instead of --shared-dir. Detect the flag by version or by a probe, and
   fall back to the path form on older hull.
3. Keep the path form, and verifyStillOurs, for nerdctl and for hull
   versions without the flag. Skip verifyStillOurs only when a descriptor
   is handed over, since then it checks something the runtime no longer
   depends on.
4. Say in docs/security.md which handoff each runtime gets and what each
   guarantees.

Not to be done under #70. That PR is the caller-side half and is independent
of the runtime interface.

Acceptance criteria

• On macOS with hull rc24 or later, swapping a parent of the workspace between
  openWorkspace and the VM start does not change the directory the guest
  receives, covered by a test that drives the swap through a seam and checks
  the argument list carries --shared-dir-fd and an inherited file.
• On an older hull, and on nerdctl, brig still passes --shared-dir and still
  runs verifyStillOurs.
• docs/security.md states the per-runtime guarantee.

Related

• Workspace path is re-resolved mid-walk, so a guest can redirect a host write #68, fix(wrap): open the workspace by descending where a guest can reach #70: brig opens the workspace by descending by handle and confirms the
  path before the handoff. This issue is the remaining half.
• Accept a directory handle for the share, not a path to resolve later hull#7, feat: Accept a directory handle for a share, not a path to resolve later hull#13: the runtime side.