fix(vfs): harden 9P frame and session boundaries

[kernalix7]

Summary

• enforce exact 9P frame envelopes and checked cursor arithmetic
• track typed single-flight request context across version, attach, walk, open, I/O, clunk, remove, and stat flows
• apply 9P2000.L Rlerror, walk, open-once, iounit, root-FID retirement, and rollover-safe FID allocation semantics
• add focused frame, session, protocol, lifecycle, and mutation-sensitive regression coverage

Scope

This patch hardens the isolated plan9fs codec/session boundary only. It does not add a transport, mount integration, InodeOps implementation, or parsed stat/read/write bodies.

Verification

• cargo fmt --all -- --check
• cargo clippy --workspace -- -D warnings
• cargo build --workspace
• focused host tests: 46 passed
• strict Miri: 46 passed
• full host suite: 4,840 passed, 0 skipped
• aarch64 and riscv64 kernel cross-builds
• x86_64, aarch64, and riscv64 QEMU integration tests
• seven targeted mutation proofs
• five-lane goal, QA, quality, security, and context review

The repository safety checker remains at its pre-existing 42 findings; the four changed VFS files add no unsafe code.