security: add tmpfs quotas and overflow hardening (H7)

security: add tmpfs quotas and overflow hardening (H7)

- Add global tmpfs quota (512MB) to prevent DoS via memory exhaustion
- Track total memory usage across all tmpfs instances with g_tmpfs_total_used
- Validate quota before allocation in tmpfs_write_impl, tmpfs_add_file, and tmpfs_create_file
- Decrement quota when freeing memory in tmpfs_unlink_impl and tmpfs_kill_sb
- Add overflow protection in tmpfs_write_impl new_cap *= 2 loop:
  - Cap per-file maximum at 256MB
  - Check for overflow before doubling
  - Return error if requested size exceeds max cap
- All quota operations protected by existing g_tmpfs_lock

Validation:
- make -j12: PASS
- make test-host: PASS (111/111)
- make test SMOKE_SMP=4: PASS (127/127)
- make test-battery: PASS (153/153)
- make analyzer: PASS

Addresses H7 from docs/URGENT_SECURITY_STATUS_2026-06-09.md