Refuse profile names that collide with reserved subvolumes

[munzzyy]

The on-device profile tooling refuses reserved subvolume names. is_reserved_subvol() in flipperone-linux-build-scripts (overlays/usr/lib/flipper-btrfs.sh) lists them:

@|@home|@root|@snapshots|@stock-snapshots|@var-log|@var-cache|boot

and create-profile, rename-profile and delete-profile all bail out with "Refusing to use reserved name". The installer creates those same subvolumes and has no equivalent check — grep -rn "reserved" src/core finds nothing.

So a profile pack named stock-snapshots (or home, or var-log) parses like any other profile and is accepted all the way to deploy_profile, which runs:

btrfs subvolume snapshot {mnt}/@stock-snapshots/@stock-snapshots_694_stock {mnt}/@stock-snapshots

{mnt}/@stock-snapshots already exists by then — run() mkdir's it before the first receive. When the destination is an existing directory, btrfs doesn't error, it names the new subvolume after the basename of the source and puts it inside. That leaves a subvolume stranded one level down in a shared area, which btrfs subvolume delete won't remove since it isn't recursive. For a profile called home the same thing happens inside the user's populated /home.

Added reject_reserved_profile_name(), called for the minimal profile and every selected extra right after the layout resolves and before blkdiscard, so it fails while the disk is still untouched. It checks the same list as the shell helper, plus whatever the active layout defines, so the two stay in step.

Two tests come with it. The first builds a ProfilePack from the real parse_pack("stock-snapshots_694_stock_pack.zst") and asserts root_subvol() equals STOCK_SNAPSHOTS_DIR — the collision is real on unmodified parsing, not something the test invents. The second checks every reserved name is refused and that ordinary names like Minimal and Desktop still pass.

test core::install::tests::profile_named_stock_snapshots_collides_with_the_stock_snapshots_dir ... ok
test core::install::tests::reject_reserved_profile_name_catches_every_shared_subvolume ... ok
test result: ok. 7 passed; 0 failed

parse_pack became pub(crate) so the first test can call it; nothing else changed in catalog.rs. Clippy is unchanged at the same 5 pre-existing warnings, none in install.rs.

Two caveats. This needs a build that actually ships an oddly named pack, so it's a guard rather than something biting today — I'd rather it match the shell tooling than rely on nobody ever naming a profile home. And I confirmed the btrfs nesting behaviour from btrfs-subvolume(8) rather than on a real filesystem, since I wasn't going to run mkfs to test it.