New-PfbFilesystem: safe-by-default creation (no implicit exports, snapshot dir, or open SMB permissions)

[dmann000]

Source: field feedback (module quality / security default).

New-PfbFilesystem currently does more than the caller asks on creation:

• Creates array_server SMB and NFS exports regardless of whether they are enabled. default_exports should default to empty unless the caller explicitly requests exports.
• Creates the snapshot directory even when -SnapshotDirectoryEnabled is not passed.
• The auto-created SMB export defaults to full-open permissions (_smb_client_allow_everyone, effectively "Everyone read"). A wide-open SMB policy applied implicitly is a security concern for a default.

Asks

• Do not create default exports unless the caller opts in (default_exports empty by default).
• Do not create the snapshot directory unless -SnapshotDirectoryEnabled is passed.
• Never apply an open "Everyone" SMB policy implicitly.
• Expose the full SMB/filesystem creation parameters directly on the cmdlet (eradication config, group ownership, multiprotocol access mode, etc.) so a single cmdlet call matches a single API call, without hand-building a request body. (Overlaps with Write cmdlets silently drop documented body parameters (~48 New-*/Update-* cmdlets) #31.)

Acceptance

Creating a filesystem with defaults produces no exports, no snapshot directory, and no open SMB policy. A Pester test covers each default. NFS/SMB parity: anything settable for NFS on creation is settable for SMB.