epic: experimental demand-paged NFS gateways (git-LFS + Perforce) with LRU cache

[hartsock]

Epic (experimental / future). Present a git-LFS-backed repository, or a
Perforce view, as a single NFS mount without materializing the whole thing
locally — an LRU working-set cache keeps only hot-path files resident and fetches
cold files on demand. Cargo-feature-gated, off by default, off the v1.0 path.

The shared insight

Both features are the same pattern: a demand-paged NFS gateway + LRU cache
over a versioned, content-addressable backing store. Build the shared core once
— a second NFSFileSystem impl beside PassthroughFs (in nessie-nfsserve) plus
a content-addressable LRU cache — then add two thin adapters. This mirrors how #52
is the shared root for the CIFS and NFSv4.1 epics.

Faithfulness

This extends the existing embedded-NFS lineage, not a new violation of the
"daemon doesn't broker bytes" thesis: that thesis governs the REST control
plane, which stays byte-free. The gateway returns AccessHandle::NfsExport and
serves over the same listener that already backs ZFS. Cold-read latency is told
honestly over the wire via NFS3ERR_JUKEBOX (the protocol's own "staging, retry"
code). Snapshots/clones map to git tags / p4 changelists — pure metadata ops that
move zero bytes. Read-only + immutable-snapshot first is the keystone: a pinned
ref/changelist is immutable, so a cache hit can never be stale.

Scope (first cut = read-only, immutable-snapshot regime)

• Design doc: docs/design/demand-paged-nfs-gateways.md (demand-paging model,
  LRU / eviction, JUKEBOX semantics, faithfulness note, read-only scope).
• Shared core: a demand-paged NFSFileSystem + a content-addressable LRU
  cache with a byte/inode budget, eviction, and pin-during-read.
• gitlfs-nfs-gateway: git tree → NFS namespace; LFS pointer blobs fetched
  lazily (batch API, sha256-verified) via partial clone; branches→volumes,
  tags→snapshots, branch-at-tag→clones.
• p4d-nfs-gateway: a p4 view pinned at a changelist → read-only NFS mount;
  namespace from p4 fstat, content demand-paged via p4 print; view@change
  == immutable snapshot.
• Cargo features (gitlfs-nfs-gateway, p4d-nfs-gateway), default off; no
  new default-build dependencies.

Non-goals (first cut)

Write-back (commit / submit-on-flush) — deferred behind its own feature + ADR;
head-follow (unpinned views); Kerberos.

Sequencing

Experimental, post-v1.0-parity, behind cargo features that never gate the parity
build. Should trail the base-hardening work (SnapMirror data plane, live gate) and
the funded protocol epics. The p4d / gitlfs NFS gateways relate to — but are a
distinct presentation of — the planned nessie-backend-p4d / nessie-backend-gitlfs
backends (see the phantom-backend reconciliation issue).

A full per-step breakdown exists in the roadmap synthesis; this epic is the
tracker.