fix(fuse): drain pipe on splice failure and handle ECONNABORTED

[yangcx000]

What

Hardens the FUSE splice receive path against partial/failed frames and connection-abort errno.

• splice() — on short splice, read_buf error, or read/write length mismatch, drain the pipe before returning so stale bytes never poison the next request frame.
  • On the recoverable read_buf-error path (the returned err carries a real OS errno, so the receive loop may continue) the drain is load-bearing.
  • On the two fatal-exit paths (short splice / length mismatch) the returned err_box! carries no OS errno, so the loop hits _ => return Err and the receiver exits — there is no "next frame". The drain there is defensive (documented inline) in case those paths later become recoverable.
• drain_pipe() helper — relies on the non-blocking fuse pipe (PipeFd::new(_, false, false)): an empty pipe returns EAGAIN (not EINTR), which stops the loop, so it cannot hang. Retries only EINTR.
• prepare_receive_buf() helper — centralizes buffer clear()/reserve()/set_len(). The added clear() makes the buffer length deterministic before the unsafe set_len, a small correctness improvement over the previous in-place set_len.
• ECONNABORTED — treated like ENODEV in the receive loop (graceful break), with a matching errno label and receive_error_labels test coverage. Both graceful-exit arms now log an info! line to distinguish a normal teardown from a hang in the field.
• Short-read/short-splice/length-mismatch detail is folded into the returned err_box! (logged once, at error level, when it propagates to fuse_session::start) rather than an extra error! at the site.

Testing

• cargo fmt -p curvine-fuse -- --check
• cargo clippy -p curvine-fuse --lib (clean)
• cargo test -p curvine-fuse --lib — fuse_receiver:: + fuse_error:: all pass

🤖 Generated with Claude Code