Re-review 2 of #313:
- n1: the cross-mount guard also matches when one path within its source
ends with the other on a whole folder name (sources listed at different
depths, e.g. 2024/x.png and x.png on a FUSE or noserverino mount).
- n2: after a file's records move and right before its unlink, the held
kept copy must still be the file at its path (fstat of the hold against
os.stat) and the cross-mount guard must still hold; otherwise the file
is kept, its records move back to it, and it counts as not removed.