[opendev9]

V2 auto-local configuration can currently coexist with legacy backend settings in C/GC, allowing C and Go to resolve objects differently. This change rejects that configuration before backend construction and makes cross-volume publication use hidden staging with an fsync before rename.

Baseline: origin/dev 6bb3c42865ab4769c1aa84a15f9d5c435aa18553.

Changes:

• Share the C configuration guard across seaf-server, GC and repair; align Go validation across all three backend sections and enable_storage_classes.
• Copy into <destination-directory>/.cf-tmp-<name>-XXXXXX, clean up failures, and keep descriptor ownership local (the existing copy_fd closes descriptors internally).
• Match native metadata directories and Go os.ModePerm: C block shard creation requests 0777, subject to umask (tested as 0755 under 0022).
• Keep routing SQL, reserve/activate/retire, object formats and enumeration rules unchanged.

Validation:

• Linux/arm64 cached cloudfile-build-base:ce14-v2: bash tests/local_storage/run.sh → Native and managed C object staging, cleanup and enumeration passed; C configuration guard and real cross-filesystem copy/failure cleanup passed.
• C copy uses actual /tmp to /dev/shm (different st_dev) and checks hidden staging, unpublished destination, copy/fsync failure cleanup, plus same-filesystem hardlinks. Backend permission and enumeration tests run for both native and managed routes.
• Linux/arm64 privileged disposable container: CF_TEST_BIND_MOUNTS=1 CF_AUTO_STORAGE_CASES=/docker-docs/features/automatic-local-storage-cases.json go test ./objstore/... -count=1 -v → PASS, ok .../objstore 0.071s. Backend, repository and shard bind mounts all pass and each fixture reproduces EXDEV for the old staging layout.
• macOS: GOCACHE=/Users/bobo/workspace/openfile/.gocache go test ./objstore/... -count=1 -v → PASS, ok .../objstore 1.033s.
• git diff --check passes.

Not covered:

• Two real S3 tests explicitly SKIP because CF_S3_TEST_ENDPOINT is not set; this is not S3 acceptance.
• The C guard tests execute the production validation function without opening a database; they do not start full seaf-server/GC processes. Full native build and process startup checks remain part of the combined build validation.
• No DEV/production deployment, data migration, fsck, live replica reconciliation or full upload/history/recovery acceptance.

Initial Linux harness attempts failed on missing writable legacy test output, disabled dependency downloads, and missing shared fixture paths. The final run uses a disposable writable source copy, a read-only existing module cache, and the explicit shared fixture; no tests are skipped to conceal those failures.

Upstream integration: GC must validate before constructing any storage backend, including offline sessions; this cannot be implemented only in the V2 path resolver. The companion Docker change should register server/gc/seafile-session.c in its upstream-patch inventory. Do not merge before combined validation.