Fix: SMB share-open no longer pops macOS auth dialog

[vdavid]

Opening an SMB share for a host not in Keychain (fresh Docker container, new NAS, colleague's laptop) used to pop the kernel smbfs credential dialog with the current OS user prefilled. Root cause: NetFSMountURLSync got NULL user/passwd plus an empty openOptions, so NetFS fell through to Keychain lookup → miss → prompt. The fix tells NetFS "this is a guest mount, don't consult Keychain" via the kNetFSUseGuestKey open option (literal key "Guest", since the constant is a #define rather than an exported symbol).

Cleaner take on #17, which tried to skip the OS mount entirely and broke path resolution (synthetic /Volumes/<share> got prefix-matched to Macintosh HD, std::fs::read_dir hit ENOENT, deleted-path recovery bounced the pane back to /Volumes).

• mount_share_sync (macOS) builds a single openOptions CFMutableDictionary that combines the existing ForceNewSession flag (path disambiguation) with the new Guest flag (no-credentials mount). Credentialed mounts already worked: we already pass user/passwd as CFStrings.
• Module doc-comment in mount.rs explains the credential-passing contract, the Keychain-fallback failure mode, and the two cases (guest vs. credentialed) we plumb through to NetFS.
• New smb_integration_mount_guest_no_dialog test (gated to target_os = "macos", requires Docker SMB containers): asserts a guest mount against smb-consumer-guest returns in < 10 s. A real credential dialog blocks indefinitely, so the tight wall-clock budget is the regression signal.
• Linux path (mount_linux.rs, gvfs-based) unchanged: the dialog issue is macOS-specific.
• No paired auth-success/auth-failure integration test: NetFS aggressively caches SMB sessions across calls, so a tight harness can't reliably distinguish "creds passed correctly" from "session reused" without forcibly tearing down the session. The auth path is exercised manually via pnpm dev against smb-consumer-auth.

Test plan

• ./scripts/check.sh --check clippy --check rust-tests --check rust-integration-tests --check rustfmt --check svelte-check green (1892 unit tests, 31 integration tests).
• cargo nextest run --run-ignored only -E 'test(smb_integration_mount_guest_no_dialog)' against the running Docker SMB containers: green in 2.5 s on a 10 s budget.
• Manual: open an SMB share via Network view against a fresh Docker container (smb-consumer-guest, port 10480) without any Keychain creds — no dialog, share mounts, contents listable.
• Pre-existing oxfmt failures in 5 unrelated markdown files (AGENTS.md, docs/notes/totalcmd-plugin-analysis.md, etc.) exist at origin/main too — not introduced here.