forensic-vfs-resolver

The generic layer resolver: sniff a byte source, match a registered prober, and descend container/volume/filesystem layers until a filesystem mounts.

This is the reader-independent core of detection — it touches only the [forensic_vfs::Openers] prober traits and the layered [PathSpec]/[Layer] model, never a concrete reader. It is deliberately split out of the forensic-vfs contract leaf so the evolving detection behavior (this crate) is firewalled from the frozen contract the fleet's reader crates pin.

The orchestration layer (forensic-vfs-engine) wires concrete probers into a [Openers], resolves a base [DynSource] from a path (EWF-by-path vs a raw file), and offers the by-path open/snapshot API; everything below that — the recursion, the sniff windows, [walk], and the snapshot view — lives here so any tool or test can drive it openers-first.

Because open cannot be an inherent method on the leaf's [Openers] from another crate (the orphan rule), it is exposed as the [SourceOpen] extension trait; bring it into scope and call openers.open(source, spec, 0).