feat: implement & test open_at

[Sl1mb0]

Closes #336

I followed the specification described here. Given that we will eventually need to test this against the wasi test-suite, any differences between the aforementioned spec and the test-suite will favor the test-suite; so significant changes may need to be made in the future.

Describe your proposed changes here.

• I've read the contributing section of the project CONTRIBUTING.md.
• Signed CLA (if not already signed).

[Copilot]

Pull request overview

Implements POSIX/WASI-like open_at behavior in the in-memory VFS so guests can open existing nodes and create/truncate files (a prerequisite for enabling host-side FS writes), and updates unit/integration tests to reflect the new semantics.

Changes:

• Refactors VFS path resolution and expands VfsCtxView::open_at to handle CREATE, EXCLUSIVE, DIRECTORY, and TRUNCATE.
• Adds extensive unit tests around open_at behavior and updates integration test expectations/snapshots.
• Makes Limiter::grow take &self (internally synchronized), simplifying ownership/mutability in component setup.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
host/src/vfs/mod.rs	Implements new open_at semantics, factors path traversal helper, and adds unit tests.
host/src/limiter.rs	Changes grow to &self to allow shared use behind a mutex.
host/src/component.rs	Adjusts limiter initialization to match the new Limiter::grow signature/usage.
host/tests/integration_tests/python/runtime/fs.rs	Updates Python FS integration test to exercise create-on-open behavior.
host/tests/integration_tests/evil/fs.rs	Updates large snapshot expectations for new VFS/open behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[crepererum]

You cannot assume that. The resource table is used by all kinds of WASI things, e.g. the HTTP implementation too. Now if someone would call for example an HTTP method before using the VFS, this assumption will break. In general, hard-coding IDs like this isn't super robust. I would rather that you create add some Option<Resource<Descriptor>> to VfsState and fill it with the resource resource the first time this method is called.

[Sl1mb0]

Oooof - yeah I do not intend to keep this, this was me playing around with get_directories to see how if it did anything for the BadDescriptor error, but we now know that's not the case.

[Sl1mb0]

also re: creating a Option<Resource<Descriptor>> in VfsState - if we need to do that, I'd like to do so in a follow up; I really want to get this merged!

[crepererum]

Thank you for pushing this all the way over the finish line 🙏