fix: harden filtered filesystem copies

[madisonbullard]

Summary

• avoid redundant APFS xattr, owner, and mode writes after clonefile
• copy directory and symlink xattrs before final metadata makes paths read-only
• tolerate an unassignable foreign group when the cloned file already has the correct owner
• add operation and path context to APFS filesystem errors
• preserve tracked files under normally filtered artifact directories such as coverage, build, and dist

Context

This includes and supersedes the focused APFS fix in #20. The original reproduction and regular-file xattr fix are from @IanMitchell commits 737c950 and d67661e. It also covers the read-only-directory edge case noted in review on #20 and the extra metadata failures found while testing real filtered clones.

Verification

• cargo fmt --all -- --check
• RIFT_REQUIRE_APFS_TESTS=1 cargo test --workspace --locked
• 76 tests passed on macOS APFS
• release build installed and checked with both rift create --no-hooks and rift remove --no-hooks

[madisonbullard]

Closing because this branch is intended only for my fork, not as an upstream contribution.