fix: add built-in cached rootfs export and import workflow

[ayomidelog]

Summary

This PR adds a built-in workflow for distributing and reusing prebuilt cached rootfs archives.

Instead of telling users to manually copy directories around the Enclave state dir, Enclave now provides first-class commands to:

• export an existing cached rootfs as an archive
• import a local archive into the cache
• fetch a hosted archive from a URL and import it directly

This is aimed at making first-time enclave up much faster when using bootstrap_method = "cached_rootfs", especially for teams that want to publish a prepared base rootfs through GitHub Releases or another artifact host.

What Changed

New rootfs command group

Added a new top-level command family:

enclave rootfs export [--state-dir PATH] (--suite SUITE | --base) --output ARCHIVE
enclave rootfs import [--state-dir PATH] (--suite SUITE | --base) [--replace] ARCHIVE
enclave rootfs fetch  [--state-dir PATH] (--suite SUITE | --base) [--replace] URL

rootfs export

Packages an existing cached rootfs into a tar or tar.gz archive suitable for publishing or sharing.

rootfs import

Imports a local archive into Enclave's cache layout under:

• <state_dir>/sandboxes/rootfs-cache/<suite>
• or <state_dir>/sandboxes/rootfs-cache/base

rootfs fetch

Downloads an archive with curl and immediately imports it into the cache.

This is the user-facing fast path for a GitHub-hosted rootfs archive workflow:

• publish archive once
• enclave rootfs fetch ... on developer machines
• use cached_rootfs during enclave up

Real Published Example

A cleaned bookworm rootfs archive has already been published as a GitHub Release asset:

• Release page: https://github.com/ayomidelog/enclave/releases/tag/rootfs-bookworm-2026-06-07
• Fetch URL:

enclave rootfs fetch --suite bookworm https://github.com/ayomidelog/enclave/releases/download/rootfs-bookworm-2026-06-07/bookworm-rootfs-clean-2026-06-07.tar.gz

That makes the intended workflow concrete and immediately testable.

UX Impact

Before this change, using a prebuilt cached rootfs still required manual file placement under the Enclave state dir.

After this change, the intended user flow is:

1. prepare a rootfs once
2. enclave rootfs export ...
3. host the archive somewhere like GitHub Releases
4. on another machine, run enclave rootfs fetch ...
5. set bootstrap_method = "cached_rootfs"
6. run enclave up

That reduces Linux-specific manual setup and makes fast first-time startup much more approachable.

Configuration Behavior

The new rootfs commands also respect configured state_dir defaults, so project-level configuration continues to work consistently without forcing users to repeat --state-dir everywhere.

Documentation

Updated:

• README.md
• docs/commands.md
• docs/enclavefile.md

The docs now describe the GitHub-hosted rootfs workflow explicitly and include the real published release URL.

Tests Added / Updated

Added coverage for:

• CLI parsing for rootfs export and rootfs fetch
• cache target resolution for suite/base selection
• archive layout detection
• gzip output detection
• top-level help visibility for the new command group

Verification

Build and static checks

• cargo clippy --all-targets -- -D warnings

Test suite

• cargo test --all-targets -- --skip integration:: --skip stress::

Direct smoke test

Verified the full rootfs artifact flow end to end:

• export cached bookworm rootfs archive
• import archive into a fresh state dir
• host archive over local HTTP
• fetch archive back with enclave rootfs fetch
• confirm restored cache contents exist in the expected Enclave cache path

Why This Matters

The motivation here is to make Enclave feel closer to a prebuilt-image workflow for first-time startup.

debootstrap is still useful for building a trusted base when needed, but users who want Docker-like first-run speed should be able to:

• build once
• publish once
• fetch once
• reuse many times

This PR provides that path directly in the CLI.