Authorize O_TRUNC before applying truncation

The current fs engine and resolver-managed backends can apply O_TRUNC before the caller permissions are checked. A denied open may therefore empty a file, and the intended Linux-compatible behavior of O_RDONLY|O_TRUNC also needs confirmation with the original fs author. Define the desired semantics, then coordinate resolver authorization with InMem and Overlay truncation timing and add focused permission tests. Deferred from #1318 to keep that PR behavior-neutral.

Start by reading the resolver authorization and truncation paths in the fs engine, InMem, and Overlay backends. Confirm the intended Linux-compatible O_RDONLY|O_TRUNC behavior with the original fs author, then define authorization-before-truncation semantics and add focused permission tests covering denied opens.

Written by the indexing model from the issue text.