Sandboxed/namespaced datastores

Currently, we just give every subsystem access to the global datastore. We usually namespace our own keys (in each service) but this will bite us eventually. Ideally, service implementations would be free to pick their own key naming schemes (and would *never* try to use the datastore as an interface to steal information from other services like namesys does with the DHT).

Note: this is totally doable (and actually quite easy) with mounts. However, it would require a migration.