Enforce sync_paths allowlist for write, rename, and delete operations

[mikaelweave]

Summary

• enforce sync_paths and exclude_paths before every mutating FUSE operation
• prevent disallowed dirty entries and cross-boundary renames from reaching iCloud
• document the hard synchronization boundary and add coverage for allowed and rejected operations

Why?

When sync_paths is configured, enforce it for every local filesystem operation that can affect iCloud:

• Create files or directories
• Write or truncate files
• Rename or move entries
• Delete files or directories
• Upload changed content

Operations outside the allowlisted paths should fail with an appropriate filesystem error such as EACCES or EPERM.

For rename and move operations, both the source and destination paths should be allowed.

exclude_paths should continue to take precedence over sync_paths.

Testing

• python -m unittest -v test_driver (with local dependency shims because the host lacks FUSE build tooling)