Artifacts can get corrupted while running integration commands

During each build, and at other times; we stage artifacts to a sandbox and then run a series of integration commands in the sandbox where the rootfs needs to be read-write. Integration commands can include things like ldconfig, fc-cache, glib-compile-schemas etc.

Because the ostree artifacts are extracted with hardlinks, and the individual extracts are subsequently staged using hardlinks; the sandbox directory rootfs is consequently populated with hardlinks which link back into the ostree repositories, so modifying those files in place will result in corruption of artifacts.

To address this, the current plan is to use fusepy in the sandbox implementation to provide a copy-on-write experience for any hardlinked files. This should only be necessary while the sandbox is running with a read-write rootfs, in other scenarios once the rootfs is integrated then the rootfs is read-only and this is not necessary.