Add --mount/--davmount WebDAV auto-mount via a managed, verified rclone

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

AGENTS.md

@@ -56,6 +56,7 @@ Never hand-edit `VERSION` or create tags manually. Never skip the tests to relea
 | Limits, cgroup layout | `SPEC.md` Resource limits, `docs/ARCHITECTURE.md` |
 | Anything above, in every release | `CHANGELOG.md` entry (`README.md` points at `VERSION`, nothing to edit there) |
 | The CI workflow or what a job needs | `.gitea/workflows/ci.yml`, `docs/CI.md` |
+| The davmount flow, pinned rclone version/key, or what `--mount`/`--davmount` accepts | `SPEC.md` (CLI options, davmount section, limits), `docs/ARCHITECTURE.md` davmount flow, `docs/RESEARCH.md` G13 |
 
 Docs describe what the system does today. No roadmap text. A gap is listed next to
 what would close it. A number in the docs needs a run behind it, else say it is unmeasured.
@@ -81,9 +82,11 @@ the script.
 
 `tests/run.sh [path/to/doos]` runs the real path: real overlayfs, namespaces,
 slirp4netns, filesystem, real downloads of the Alpine and Ubuntu images, real apt/apk installs, the size
-freeze (about 4 minutes in total, needs network, `pasta`, `gpg` and cgroup v2 delegation). Add a case for every behavior change. A green run is required
-before release. On Ubuntu 24.04+ the AppArmor profile in `apparmor/doos` must be
-installed once for the binary being tested (`doos apparmor`; needs sudo, ask the user, do not do it yourself).
+freeze, a real WebDAV round trip through a disposable local `rclone serve webdav` fixture (about 4-5
+minutes in total, needs network, `pasta`, `gpg`, `unzip` and cgroup v2 delegation). Add a case for every
+behavior change. A green run is required before release. On Ubuntu 24.04+ the AppArmor profile in
+`apparmor/doos` must be installed once for the binary being tested (`doos apparmor`; needs sudo, ask the
+user, do not do it yourself).
 
 ## CI
 
@@ -105,4 +108,6 @@ The Makefile is a thin wrapper; the logic lives in `CMakeLists.txt`, `scripts/`,
 - State dir: `$DOOS_HOME`, else `$XDG_DATA_HOME/doos`, else `~/.local/share/doos`.
   Tests use a temp `DOOS_HOME`; never point tests at the user's real store.
 - Build: `cmake -S . -B build && cmake --build build`.
-- Requirements: Linux >= 5.11, `slirp4netns` for the default network mode.
+- Requirements: Linux >= 5.11, `slirp4netns` for the default network mode. `unzip` and `fusermount3`
+  (or `fusermount`) are needed only for `--mount`/`--davmount` against a `dav://`/`davs://`/`http(s)://`
+  source; doos installs its own `rclone` under `$DOOS_HOME/tools/`, never the system's.