vfs: enforce readonly state on open handles

[harjothkhara]

MemoryProvider.setReadOnly() prevented new writable handles from being opened,
but handles opened before the transition retained write access. This allowed
descriptor-based writes and truncation to bypass the provider's documented
read-only state.

Pass a live provider-state callback to MemoryFileHandle and check it at each
mutation primitive. This covers descriptor and direct-handle operations,
including delegated async, vector, and append-mode writes, while preserving
EBADF precedence for handles that were not opened for writing.

Regression tests cover:

• writeSync() and ftruncateSync() through pre-existing descriptors
• append-mode descriptors opened before setReadOnly()
• async handle write(), writeFile(), truncate(), and writev()
• unchanged file contents after rejected mutations

Validation:

• python3 tools/test.py test/parallel/test-vfs-memory-provider.js test/parallel/test-vfs-memory-file-handle.js
• JavaScript lint on the three changed files

Fixes: #64401

[harjothkhara]

Tested this end to end.

Before the fix: the example from #64401 still writes to the file after it's set read-only — bug confirmed.

After the fix: that write is blocked with EROFS, the file is unchanged, and the new test passes. All 97 vfs tests pass and lint is clean.

Other write paths (truncate, append, write streams) are blocked too, and read-only handles still give the original EBADF.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.49%. Comparing base (62ca1ba) to head (298698e).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64403      +/-   ##
==========================================
- Coverage   90.51%   90.49%   -0.03%     
==========================================
  Files         797      797              
  Lines      277688   277706      +18     
  Branches    53356    53353       -3     
==========================================
- Hits       251338   251297      -41     
- Misses      16753    16798      +45     
- Partials     9597     9611      +14     

Files with missing lines	Coverage Δ
lib/internal/vfs/file_handle.js	99.49% <100.00%> (+<0.01%)	⬆️
lib/internal/vfs/providers/memory.js	95.89% <100.00%> (+0.03%)	⬆️

... and 31 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[harjothkhara]

@trivikr @mcollina could one of you take a look? This fixes #64401. CI passed on 2026-07-26 and all new lines are covered.

[trivikr]

vfs is having a big change in #63653, and many PRs are waiting for it to land.

[harjothkhara]

@trivikr @mcollina this was waiting on #63653, which closed on Aug 31 without landing. Is this reviewable now, or should I rework it to fit the current vfs direction (#65798)? I can rebase and re-run CI.

[mcollina]

@harjothkhara it was actually landed manually. If you rebase, this can move.

[harjothkhara]

Thanks @mcollina, my mistake on #63653. Rebased on main.

[mcollina]

lgtm

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/78458/