Fix concurrent same-content transfers, disk-full handling and small-frame writes

[TeoSlayer]

Summary

Four fixes to file transfer and framing, found by running a node in a 1 GB container under load.

Changes

• Several transfers of the same content at once no longer fail. The .partial is named after the content hash so a retry can resume it. Two peers sending the same file (or one sender on two connections) therefore wrote the same file, and all but the first failed at the final rename. The first transfer keeps the resumable .partial; a concurrent one gets a private file, removed if it does not finish.
• A file that cannot fit on the receiver's disk is refused at INIT, keeping 16 MiB in reserve. The byte quota is a fixed number and can be larger than the disk: a transfer ran until the disk was full, failed, and left its bytes in .partial, where they kept the disk full and blocked incoming messages. If a write still hits ENOSPC, that .partial is deleted.
• A refusal at INIT is reported as a refusal. The sender took any non-INIT_ACK reply for a receiver without streamed-transfer support, so the caller fell back to pushing the whole file in one frame at a peer that had just declined it.
• WriteFrame sends a frame of up to 64 KiB as one write. Header and payload as two writes made the payload wait on Nagle and the peer's delayed ACK.

Wire format is unchanged. The free-space check uses statfs on unix and is skipped elsewhere.

Test Plan

• go build ./..., go vet ./...
• go test ./... -count=1 and -race
• New tests: four concurrent transfers of one payload all succeed and leave no .partial; a transfer is refused when free space is one byte short and accepted when it fits; a disk-full write removes the .partial while other write errors keep it; small frames are one write and round-trip.
• In a two-container lab: four concurrent transfers of the same 20 MB file went from 3 of 4 failing to 0 of 4.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[TeoSlayer]

Converted to draft after review; two things to fix before this merges (nothing ships until a stable tag, but both are regressions against main).

1. Resume regression (filestream.go around lines 642-651). A retry that arrives while the stalled connection is still open on the receiver (idle timeout is 2 minutes) gets a private .partial and restarts at offset 0; main resumes mid-file in the same scenario. The stale .partial is then orphaned and counts against the quota, and with a quota set the retry is refused outright ("receiver disk quota exceeded") where main accepts it.
2. Build break on some unix targets (filestream_disk_unix.go:3). //go:build unix no longer compiles on openbsd, netbsd, solaris and illumos; main does. linux, darwin, windows, freebsd and android are fine.

The rest reviewed well: wire bytes are unchanged, pilotctl already handles res.OK == false, and the new concurrency test fails on main and passes here. The handleChunk ENOSPC path is not covered by the PR's own tests (it does work against /dev/full).