#1160 macOS: fall back to fsync on filesystems that reject F_FULLFSYNC

On some macOS filesystems (the build machine's AppleVirtIOFS shared folder, for example), fcntl(F_FULLFSYNC) returns ENOTTY for files and directories while plain fsync works. Every AFT durable write failed there, so configure refused the project (cache_key_probe_failed).

• The shared durability helper falls back to fsync only for ENOTTY, ENOTSUP or EINVAL on Apple targets. Other errors, and errors from the fallback itself, still propagate. One warning per process names the filesystem.
• Every production durable sync now goes through the helper. New sync_data and sync_dir_handle keep the existing semantics. A source-scan test fails if production code calls sync_all or sync_data directly, with no exceptions allowed. Stores that intentionally don't sync are unchanged.
• The warning goes to stderr through the redacted diagnostic path rather than env_logger, because syncs also run in the panic hook and a logger re-entry there could deadlock.

Verified natively on AppleVirtIOFS: configure failed before the fix and succeeds after it, with exactly one fallback warning. On Linux: 214 durability, edit, persistence and views tests, the compile with warnings denied, and the Windows check.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Falls back from F_FULLFSYNC to plain fsync on macOS filesystems that reject full sync, so durable writes no longer fail and setup no longer refuses a project on mounts like AppleVirtIOFS shared folders.

• Routes every production durable sync through a shared helper that falls back only on ENOTTY, ENOTSUP, or EINVAL; other errors and errors from the fallback itself still propagate.
• Warns once per process to stderr through the redacted diagnostic path, bypassing env_logger because syncs also run from the panic hook.
• Adds a source-scan test that fails if production code calls sync_all or sync_data directly, with no exceptions allowed.
• Keeps data-only and pinned-directory sync semantics unchanged for callers that need them.