Advanced resource workflows: writable volumes and image operations

[mkaltner]

Scope

Track advanced operational workflows intentionally deferred from the initial Android parity/handoff milestone:

• writable volume workspace: create file/folder, edit with conflict handling, rename, move, delete, upload, download, and selected-file restore;
• advanced volume backup/import/policy behavior not covered by the current basic backup surface;
• image tagging, streamed archive export, vulnerability patch launch/progress/history, and clear post-patch deployment semantics.

Requirements

• Revalidate current iOS and Arcane contracts first.
• Extend libarcane-kotlin before Android UI when typed contracts are missing.
• Enforce bounded file handling, path safety, cancellation, streaming, storage-picker/share behavior, permissions, and destructive confirmations.
• Keep long-running work lifecycle-safe and represented through the existing operation model where applicable.
• Test against disposable volumes/images and clean up created resources.

This is deferred roadmap work, not a blocker for the current Android handoff milestone.

[mkaltner]

Cross-link: #66 lands only the focused standalone-container workflows (create, supported edit/recreate, commit to image, and Compose-to-project on supported servers). Writable volume operations, image tagging/export/patch workflows, and advanced backup/import behavior remain deferred here.