fix(volumebind): create a missing read-write sub_path at the bind

[teemow]

Problem

Since the existing-volume mounts (#234), CreateActor takes a sub_path per existing volume, but the bind refuses one that does not exist yet (internal/volumebind, "sub_path does not exist on the volume"). A caller that assigns the directory name inside its own create call, kagent's CreateSession for one (it picks the Session id and mounts sessions/<id>/ of the workspace volume), cannot create the directory before the actor exists, so every such actor fails at its first resume.

Beside it, validateTemplateVolumesUnchanged treated an existing-volume declaration like a durable volume: adding an existing-volume slot to a template made every actor's repoint FailedPrecondition, although such a volume holds no snapshot data.

Proposed solution

• The bind creates a missing read-write directory. For a read-write mount whose sub_path's last component is missing, ateom's volumebind.Prepare creates it: mkdirat beneath the parent, which is opened the way the bind resolves a sub-path (RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS | RESOLVE_NO_XDEV), then owned by the user the mounting container runs as (read from its OCI bundle, so an image that runs as a non-root USER can write it) and 0770 whatever ateom's umask. The parent must exist: an actor is given a directory of its own, not a tree. A missing parent, a symbolic link in the path, a file under the name, a read-only mount, a READ_ONLY_MANY volume and a read-only file system keep failing with their reason. Every creation runs before any bind, so a read-only mount of a directory a read-write mount creates finds it whatever the order of the mounts.
• MountDir moves from volumebind to ocispec, which volumebind now imports for the bundle's spec (the other direction was a cycle).
• Repoint: existing-volume declarations and their mounts are exempt from the unchanged-volumes check, like system_info volumes: the actor supplies them at create or not at all, and an actor without a reference to a newly declared one gets no mount of it.
• docs/csi-volumes.md and the VolumeMount.sub_path comment say so; the existingvolumes e2e leaves session a's directory for Substrate to create and checks its mode, session b's stays made ahead.

Upstream: follows agent-substrate#1637's shape like #234; the same change is prepared for upstream once that lands.

Acceptance criteria

• CreateActor with an existing READ_WRITE_MANY volume and a sub_path whose last component is missing creates it (0770, the container's user) and binds it; a missing parent, a symlink in the path, a file, an unwritable parent and a path outside the volume are refused with the reason: TestCreateVolumeDir (eleven cases), TestProcessUser, TestBoundMounts
• The e2e that mounts a session directory nothing created passes: TestExistingVolumes/MountsSubPathsAtDeclaredPaths PASS at head 754f595 on the e2e-test lane (https://github.com/giantswarm/substrate/actions/runs/37979928552/job/113987543465) and both runtimes of the E2E job (https://github.com/giantswarm/substrate/actions/runs/37979928804/job/113987745031); the unit tests in run-tests of the same run
• A template that adds an existing-volume slot repoints existing actors without FailedPrecondition: TestValidateTemplateVolumesUnchanged (six new cases), TestUpdateActor_RepointTemplate (tmpl-g)
• Carried as one upstream-ready commit (782df2a) with its FORK.md row (754f595, fork-ledger green); released as v1.7.0-rc.2 (tag at the rebase merge 8e4fb7e; images and charts on gsoci, CircleCI pipeline 556)

Closes #238.

---

This pull request was written by an agent.