…wn (fork gap cloudflare#3)

Fork gap cloudflare#3 reported that a nested native child_process.spawn() from a
NON-drainProcess child hit EPERM on VFS writes (a registry fetch's cacache
mkdir failed), while the same write from a drain child succeeded -- the
drain/non-drain asymmetry was the sharp edge iso worked around by making every
generic child a drain child.

Investigation shows the write-permission path has NO drain-conditional gate on
this branch: RootDirectory::add (io/worker-fs.c++) returns NOT_PERMITTED only
when no shared writable store is reachable (tryGetSharedStore -> IoContext /
module-eval fallback / stack scope), which is independent of drainProcess. The
gate that produced gap cloudflare#3 was the PRE-re-root read-only root: before
'spike(vfs-root-mount): re-root the shared writable VFS at / instead of /tmp',
only /tmp was writable and '/' was read-only, so cacache/npm writes to cache
paths OUTSIDE /tmp hit the read-only root -> NOT_PERMITTED (surfacing as EPERM).
The re-root routes the ENTIRE root to the shared writable store, so the fix is
already present; no runtime change is required.

This regression test pins the invariant: a nested spawn writes a cacache-shape
tree (mkdir + writeFileSync under '/', OUTSIDE /tmp) and must succeed for BOTH a
non-drain AND a drain spawner -- proving write permission does not depend on
drain mode. It would have failed pre-re-root (write outside /tmp ->
NOT_PERMITTED).

Test only, no runtime behavior change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>