move fs templating out via static copy, handling /tmp

Right now we have a lot of API surface to create files and such. Are we sure we need an internal tmpfs in order to pivot cleanly? If we assume the host's `/tmp` is tmpfs, it seems not so bad to just leak that? Maybe....or maybe we change systemd to mount /run/user/$uid/tmpfs as a separate fs by default? (Or use FUSE...)

Actually regarding /tmp, in fact, we should probably use `/tmp/containers-XXXXX` for `/tmp` in the container so that the host's systemd-tmpfiles cleans it up properly.