Adds a boot flag choosing how virtiofsd is launched per --mount:
- unshare (default, previous behavior): virtiofsd runs inside
'podman unshare' with --sandbox chroot, mapping guest UIDs into
the invoking user's subuid range.
- direct: virtiofsd runs as the invoking user with --sandbox none,
mapping guest UIDs 1:1 to host UIDs.
The direct mode is needed when the shared directory itself lives on
a virtiofs/fuse mount that rejects subuid-range UIDs (e.g. nested
boco): guest writes through the subuid mapping then fail with
EINVAL, breaking anything that writes to shares as a non-root guest
user (databases, agent workspaces).
Direct mode also cannot use the chroot sandbox (unprivileged
chroot() is not permitted), so it falls back to --sandbox none;
served trees are then not symlink-escape-protected.
Verified both modes boot and serve mounts (alpine guest).
marvin