feat(fs): add layer fork workflows

[Icemap]

Summary

• add ti fs fork-layer, list-layer-chain, and delete-layer with structured output, dry-run support, and explicit authorization
• add writable layer and read-only checkpoint FUSE mounts, including local safety validation and mount state routing
• reject unsupported recursive layer copy and validate the Drive9 companion surface during install and update
• add complete fake-companion, black-box, and hosted layer lifecycle coverage, and update README/spec documentation
• include the E2B filesystem example submodule registration already carried by this feature branch

Validation

• make test
• make e2e
• TI_DRIVE9_BIN=<official-drive9-99aceec> make live-e2e-fs
• go vet ./...
• sh -n scripts/install.sh
• git diff --check

The authenticated FS suite passed against the official Drive9 99aceec release artifact and aws-ap-southeast-1, including fork, chain, delete, writable layer mounts, historical checkpoint mounts, parent rollback with a pinned child, and final child commit.