FUSE: pass Branches::Ptr by value with empty-branches guards

Previously most FUSE ops took a reference to the live cfg.branches
object. With atomic_load now producing a shared_ptr snapshot, pass
it by value: the op works against a single stable view of the
configuration for its whole lifetime, immune to concurrent
reconfiguration.

Also bail out with -ENOENT when the policy returns an empty branch
set rather than dereferencing branches[0]. This was reachable if a
policy rejected every branch (e.g. everything readonly while
looking for a writable target).

Covers access, chmod, chown, create, getattr, getxattr, ioctl,
link, listxattr, mkdir, mknod, open, readdir (cor/cosr),
readlink, removexattr, rename, rmdir, setxattr, statfs, statx,
symlink, truncate, unlink, utimens.

While here, in _getattr only dereference st_->st_mode when lstat
succeeded (it is otherwise uninitialized).

src/fuse_ioctl.cpp

@@ -32,6 +32,7 @@
 #include "fs_open.hpp"
 #include "fs_path.hpp"
 #include "mergerfs_ioctl.hpp"
+#include "state.hpp"
 #include "str.hpp"
 
 #include <string>
@@ -128,7 +129,7 @@ _ioctl_file(const fuse_req_ctx_t   *ctx_,
 static
 int
 _ioctl_dir_base(const Policy::Search &searchFunc_,
-                const Branches       &branches_,
+                const Branches::Ptr   branches_,
                 const fs::path       &fusepath_,
                 const u32             cmd_,
                 void                 *data_,
@@ -142,6 +143,8 @@ _ioctl_dir_base(const Policy::Search &searchFunc_,
   rv = searchFunc_(branches_,fusepath_,branches);
   if(rv < 0)
     return rv;
+  if(branches.empty())
+    return -ENOENT;
 
   fullpath = branches[0]->path / fusepath_;