fix(ateom): convert a pre-per-volume durable snapshot on restore

[teemow]

Problem

Since the one-tar-per-volume layout (agent-substrate#2110, carried in #260) a gVisor snapshot keeps one durable-dir-<volume>.tar per durable volume. A snapshot written by 1.7 keeps them all in one durable-dir.tar, and #265 makes ateom refuse such a restore with FailedPrecondition. That is safe, but no upgrade path: every actor suspended on 1.7 loses its conversation and durable volumes on the step to 1.8, and so does every actor created from a 1.7 golden, unless the snapshots are reset, which loses them too.

Proposed solution

ateom's restore converts the old layout instead of refusing it:

• tarutil.Split rewrites durable-dir.tar into one archive per declared volume, tar to tar with nothing extracted; the volume directory's own entry becomes the ./ root entry CreateWithRoot writes. Only the xattr PAX records are kept, so a stale path/linkpath record cannot override the new names. It is all or nothing (written beside the destination, renamed into place after the input was read to the end) and leaves its input alone. It is an exported function of an internal package, so the ActorTemplate reconciler can call it too.
• convertLegacyDurableLayout (gVisor ateom) runs it when durable-dir.tar is present, before untarDurableVolumes extracts each volume as it does for a current snapshot: same os.Root, fd-relative extraction, same device and xattr restrictions of tarutil: refuse device nodes and unvetted xattrs on extract agent-substrate/substrate#2111. durable-dir.tar stays, so an interrupted conversion runs again; the next checkpoint writes the current layout.
• A snapshot that does not convert (unreadable or truncated archive, an entry outside every declared volume, a top-level non-directory, a hardlink across volumes) is still refused with FailedPrecondition, now with its cause; the volumes stay untouched and the snapshot directory gains no partial conversion.
• A snapshot in the current layout is restored as before, its directory untouched.

The micro-VM ateom on the line still writes and reads the single durable-dir.tar and needs no conversion. One upstream-ready commit, plus a docs(fork) commit for its FORK.md row; rebase-merge.

Acceptance criteria

• TestUntarDurableVolumesConvertsLegacyLayout: a 1.7 snapshot (one durable-dir.tar written by tarutil.Create over the volumes directory, as the 1.7 checkpoint did) restores every volume's data, writes the per-volume tars, gives a volume without entries none, and converts again on a second restore.
• TestUntarDurableVolumesCurrentLayoutUnchanged: a 1.8 snapshot restores and its directory is byte-for-byte unchanged.
• TestUntarDurableVolumesRefusesUnconvertibleLegacyLayout: an entry outside every volume, a truncated archive and a non-tar are refused with FailedPrecondition wrapping the layout error and the cause; the volume and the snapshot directory are untouched.
• TestSplitRoundTrip / TestSplitRefuses (internal/tarutil): names only PAX can hold, symlinks, hardlinks, user xattrs, the directory's mode and mtime survive the split; every refusal leaves nothing behind.
• go test -race ./internal/tarutil/ ./cmd/ateom-gvisor/ ./cmd/ateom-microvm/ and golangci-lint on the touched packages pass locally; CI green.

Replaces #273, which conflicted with the line after a FORK.md row landed.

Closes #271

This pull request was written by an agent.