feat: mount an existing read-write-many volume at a sub-path #227

Problem

A Session that works in a shared workspace needs Substrate to mount part of a volume that already exists and outlives the actor: its own directory read-write and another directory of the same volume read-only. On this line an ActorTemplate's external volume is created per actor from a capacity and a StorageClass, attached single-node-writer and deleted with the actor; a VolumeMount has a name and a path, no sub-path and no read-only flag; an Actor carries no volume of its own.

Upstream: configurable access modes, READ_WRITE_MANY on the per-actor template, are agent-substrate#1988 (open); volumes shared across actors with a lifetime of their own are agent-substrate#1637 (open, no API yet); a per-actor sub-path on worker-pool storage is agent-substrate#282 (open, its tie to the worker pool questioned in review); one volume at several paths is agent-substrate#1612.

Proposed solution

One carried, upstream-ready change on this line, designed in agent-substrate#1637 and on top of agent-substrate#1988's access modes:

• CreateActor takes per-actor references to existing volumes (CSI driver, volume handle, access mode READ_WRITE_MANY), attached and published by atelet like an external volume but never created or deleted by Substrate.
• A VolumeMount gains a sub_path and a read_only flag; the same volume may be mounted at two paths of one actor.
• An actor created without a reference gets neither the volume nor its mounts; its create request is unchanged.
• Pause, resume on another node and delete detach and attach the volume and never touch its content.
• Recorded in FORK.md with its upstream exit.

Acceptance criteria

• e2e on kind with an NFS CSI driver: an actor created with a volume reference mounts sub-path sessions/a read-write and mirrors read-only at the declared paths
• Two actors on the same volume each write only their own sub-path; a write to the read-only mount fails
• Pausing, resuming and deleting an actor leaves the volume and the other actor's files intact (no PV deleted)
• An actor of the same template created without a reference has no such mounts, and its create request is unchanged (unit test)
• A reference to an unknown driver or a missing volume is refused at create with that reason
• FORK.md row naming the upstream issue it follows; released as a line release candidate