Make workspace writes resilient to non-coherent host mounts (~2ms metadata lag)

Summary

On a bind-mounted host filesystem (Docker Desktop on macOS, virtiofs), a newly created file, directory, or symlink is **not visible to stat/lstat/ realpath/existsSyncfor 1–2ms after the creating syscall returns**, even thoughopen/read/write` on the same path succeed immediately.

deepsec assumes POSIX durability-on-return in several places — it creates a path and then immediately stats, realpaths, or branches on existsSync. Under this mount those calls take the "doesn't exist" branch, and init fails or silently does the wrong thing.

Request: make the workspace write paths tolerate a short metadata lag.

Environment

• Host: macOS
• Sandbox: Docker Sandboxes (sbx)

Proposed change

1. A small internal helper — settlePath(p) — that retries lstat with a short backoff (e.g. 6 attempts, 1/2/4/8/16/32ms) and is called after creating a path the code is about to stat, realpath, or branch on.
2. Stop branching on existsSync immediately after a create. Where the question is "did I just make this?", track it in-process instead of asking the filesystem.
3. Wrap realpathSync on freshly created workspace paths, and the mkdirSync in ensureProject/registerProject, in a retry-on-ENOENT.
4. DEEPSEC_FS_SETTLE_MS escape hatch (default e.g. 50ms cap) so users on slower sync backends — Mutagen-based "Synchronized file shares" can lag far more than virtiofs — can raise it.