Building a custom gofer (e.g. for network-backed storage, encrypted filesystems, or tiered caches) currently requires forking the runsc binary and copying/maintaining unexported setup and seccomp code. This adds an Extension interface that lets custom filesystem backends register with the stock gofer and serve LisaFS connections for specific mounts without forking.

The interface follows the socket.Provider-style registration pattern: NewConnection returns a nil lisafs.ConnectionImpl to decline a mount, and the first registered extension that returns a non-nil implementation handles it. NewConnection receives the sandbox's OCI runtime spec, the specific mount being served, the resolved mount path, and readonly state, so extensions can read sandbox-wide configuration from spec.Annotations and per-mount configuration from the mount itself without a side-channel.

Stock fsgofer remains the default when no extension claims a mount. All mounts still share one lisafs.Server; extensions only choose the per-connection lisafs.ConnectionImpl and lisafs.ConnectionOpts now supported by lisafs.Server.CreateConnection. SeccompRules lets extensions declare additional syscalls, merged with the stock allowlist before installation.

Zero behavior change when no extensions are registered: the stock fsgofer path runs unchanged, identical to today. This follows the same pattern as the network plugin: inactive when not configured, no impact on the default path.

New package runsc/fsgofer/extension defines the Extension interface and registration. The gofer command iterates registered extensions for each mount before falling through to fsgofer. The seccomp filter install path accepts extra rules for merging extension rules with the stock allowlist.

Also adds documentation in g3doc/user_guide/filesystem.md and pkg/lisafs/README.md describing how to use the extension interface.

PiperOrigin-RevId: 918523699