feat(metatag-dirs): nested directory hierarchy via path metatag + flags

Implements the source PDF's prescribed model for directory structure:
'treat the CZYX cube as the only persistent store, with system calls that
operate on CZYX records and Null-space flags rather than paths and inodes.'
Nested dirs are RECONSTRUCTED from a per-record `path` metatag, so the
filesystem does not need recursive inode trees.

- cubecoords: add CubeHeader.path (Option<String>) + HAS_PATH flag bit (1<<8);
  refresh_flags() sets it. Cubestore TLV codec now serializes/deserializes the
  path as tag 13 (persists across checkpoint/reopen).
- cubestore: scan_by_path (exact), scan_by_path_prefix (dir listing by path
  prefix; bare '/etc' normalized to '/etc/'), plus query_by_path/_prefix
  returning decoded (coord,header,body).
- cubesys: `put` verb gains path=<p>;
  new `query-path <dir>` verb reconstructs a directory listing from metatags.
- ConcurrentStore: query_by_path(_prefix) delegate to inner CubeStore.

Verified live in VM: migrated /etc/passwd, /etc/network/interfaces, /usr/bin/ls
at unrelated coordinates; 'query-path /etc' returns the two /etc files,
'/usr/bin/ls' correctly excluded. cubestore 8/8 tests pass.

Refs: OS-in-CUBE migration, query-layer prototype.

cubesys/src/store.rs

@@ -574,6 +574,19 @@ impl ConcurrentStore {
         out
     }
 
+    /// Reconstruct a directory listing from `path` metatags: every record
+    /// whose `path` header field is under `dir` (the PDF's "operate on CZYX
+    /// records and Null-space flags rather than paths and inodes"). Delegates
+    /// to [`CubeStore::scan_by_path_prefix`].
+    pub fn query_by_path_prefix(&self, dir: &str) -> Vec<Czyx> {
+        self.inner.read().unwrap().scan_by_path_prefix(dir)
+    }
+
+    /// Exact-path metatag lookup. Delegates to [`CubeStore::scan_by_path`].
+    pub fn query_by_path(&self, path: &str) -> Vec<Czyx> {
+        self.inner.read().unwrap().scan_by_path(path)
+    }
+
     /// The `owner_local_user` stamped on the record at `key`, if it has one.
     /// Used by owner enforcement (Task 6): a mutating command may only
     /// overwrite a record whose owner matches the session's identity owner.