Add rootfs tests

[ValentaTomas]

• Refactor nbd testing
• Add a simple test for the failing NBD writes

I had to change the tests to run as root, because NBD requires that.
I also added -race in the unit tests—will remove and re-add it in another PR if it is problematic here to quickly merge the hotfix.
More tests for the NBD should follow in next PR too.

---

Note

Adds NBD direct-path tests with new test utilities, enhances mount-rootfs (empty/verify/log), enables NBD and root-permission tests in CI, and removes legacy mock-nbd.

• Tests (orchestrator):
  • Add nbd direct-path read/write tests (incl. O_DIRECT and large dd) in internal/sandbox/nbd/path_direct_test.go.
  • Introduce test utilities in internal/sandbox/nbd/testutils/* (ZeroDevice, BuildDevice, NBD device/mount helpers, cleaner, logger overlay, template rootfs helper).
• CLI:
  • Expand cmd/mount-rootfs with flags: -empty, -size, -block-size, -verify, -log; supports creating empty rootfs, integrity/journal verification, and structured logging.
  • Simplify start.sh to pass through args.
• CI:
  • Enable NBD (modprobe nbd), add udev rule to disable inotify on nbd*, and run go test with sudo in PR workflow.
• Refactor/Removals:
  • Remove cmd/mock-nbd/ and mock-nbd Makefile target; drop github.com/pojntfx/go-nbd dependency.
  • Add DiffStore.RemoveCache() for cleanup; minor header comment tweak.

^{Written by Cursor Bugbot for commit da8c36d. This will update automatically on new commits. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ValentaTomas]

Merging to the other PR after tests pass.