FUSE: pass Branches::Ptr by value with empty-branches guards

Previously most FUSE ops took a reference to the live cfg.branches
object. With atomic_load now producing a shared_ptr snapshot, pass
it by value: the op works against a single stable view of the
configuration for its whole lifetime, immune to concurrent
reconfiguration.

Also bail out with -ENOENT when the policy returns an empty branch
set rather than dereferencing branches[0]. This was reachable if a
policy rejected every branch (e.g. everything readonly while
looking for a writable target).

Covers access, chmod, chown, create, getattr, getxattr, ioctl,
link, listxattr, mkdir, mknod, open, readdir (cor/cosr),
readlink, removexattr, rename, rmdir, setxattr, statfs, statx,
symlink, truncate, unlink, utimens.

While here, in _getattr only dereference st_->st_mode when lstat
succeeded (it is otherwise uninitialized).

src/fuse_readdir_cor.cpp

@@ -47,7 +47,7 @@ static
 inline
 int
 _concurrent_readdir(ThreadPool          &tp_,
-                    const Branches::Ptr &branches_,
+                     const Branches::Ptr  branches_,
                     const fs::path      &rel_dirpath_,
                     fuse_dirents_t      *dirents_)
 {