emulation: support initial Darwin directory removal and exclusive rename

[gmh5225]

Darwin workloads could not remove declared initial directories or request an exclusive regular-file rename. Add explicit initial-directory removal while preserving held objects, and support renameatx_np(RENAME_EXCL) without guessing filesystem behavior.

• removable: true / DarwinFileOptions::RemovableDirectories requires an explicit non-root directory and a mutable immediate parent. The caller declares an ordinary non-mount object with one namespace identity; known flags, aliases and contradictory devices reject admission. Removed names cannot resurrect from immutable inputs. FD/dup/CWD references retain the original object and parent chain; replacement objects cannot inherit old observations. Implicit child directories survive file unlink, and fixed initial storage/entry costs remain reserved.
• RENAME_EXCL=0x4, optionally combined with RENAME_NOFOLLOW_ANY, rejects a distinct existing file/directory with EEXIST before mutation/mount checks. Earlier path errors retain priority. An absent target reuses the existing bounded rename transaction. Same-object exclusive rename remains explicitly unsupported because its native result depends on unconfigured filesystem case sensitivity. SECLUDE, SWAP and directory-source rename remain unsupported.

C++/C/CLI/Python share the contracts and original native comparison programs. All 11 language guides document the boundaries and current required test inventory.

Validation on Apple Silicon Release at the final source:

• Complete Darwin: 1,097 registered; 665 passed, 432 unavailable-backend skips, zero failures; all 108 required ARM64 HVF identities executed.
• Rename-focused: 44 passed, 12 unavailable skips, including eight new direct 4K/16K cases. Earlier initial-directory focused checks: 27 passed, 12 unavailable skips, plus a snapshot-only alias check. Counts overlap.
• Public C/CLI/report: 191/191; Python: all five guest combinations in 19.241s. Original native macOS workloads: 26/26 on the unchanged-binary recheck; separate exclusive-rename raw-call probe: 26 checks.
• Format/whitespace (12 complete-PR C/C++ files), docs (264 Markdown / 10 locales), capabilities (22), source provenance (5,738 files / latest 16 commits), and primary source/binary/evidence reconciliation passed. Unchanged evidence-runner tests passed 66/66 in the initial-directory increment.

Preserved limitations and failures:

• Earlier initial-directory full gates had intermittent existing HVF file/rename timeouts. Instrumentation reproduced one at 5.008s wall time versus 0.171s process CPU time. Exact-method and old-program comparisons passed, but the latency cause remains unresolved. Diagnostic code and temporary fixture replacements were removed before final gates.
• The first exclusive-rename native run timed out on the existing return case; its other 25 cases passed. Three rechecks of the same unchanged binary completed in 0.014–0.034s, followed by all 26 cases passing. The original failure remains unexplained. All original 5s bounds are unchanged; passing reruns do not establish latency stability.
• An inconsistent inode/snapshot test input was corrected with its initial failure retained. Independent review was unavailable; primary audits and executable native comparisons were completed.

Evidence is retained under build-hvf-arm64/initial-directory-validation-summary.json and exclusive-rename-validation-summary.json, including failed runs and diagnostic artifacts. Full GitHub CI and physical iOS remain separate; Intel HVF Actions remain suspended. Cross-parent/directory rename, links, general permissions/mount topology, Mach/dyld/framework support and the broader macOS/iOS environment remain unfinished.