macOS: harden volume discovery and FUSE-T teardown

Run display discovery asynchronously and bound batched disk-image inventory
queries. Filter auxiliary mounts by basename, filesystem and owner, and
keep unresolved candidates separate from verified volumes. Allow targeted
dismounts despite incomplete discovery while requiring complete results
for slot allocation and empty-inventory decisions.

Use nonthrowing GUI snapshots with monotonic freshness, completion events
and safe window lifetimes. Suspend inactivity decisions while the snapshot
is stale, without restarting idle timers: activity counters are cumulative
per volume instance. Refresh logout targets and retry only failed ones.
Show a progress dialog for interactive unmounts, but keep automatic ones
synchronous, so a quit or logout request that arrives meanwhile is handled
afterwards rather than refused. Guard core operations against reentry and
route wait-dialog requests only from worker threads, so a main-thread
message cannot wait for itself.

Bind teardown to captured mount and service identities, including process
start time. Report a service exit that cannot be confirmed after auxiliary
mount removal as a distinct error that keeps the original details. Such
volumes are not retried, and a multi-volume unmount reports all of them
together with any other failure or a declined prompt. Warn about it after
automatic unmounts and at quit, and keep the background application until
the warning is acknowledged. Keep rollback responsive, and let services
remove their auxiliary directories without probing mounted paths. Preserve
released /control compatibility and perform best-effort cleanup for older
services.

Reap bounded subprocesses as soon as their output ends. A child that
survives SIGKILL is reaped by a later call, which starts no new child until
then. Keep subjects and subprocess command, status and error output when
formatting exceptions for wrapping and logs. Clarify discovery and rollback
diagnostics. Fix the localization-dependent busy-volume regression
assertion and extend discovery, snapshot, process identity, cleanup, GUI
lifecycle, inactivity and teardown coverage.

Tests/macos_volume_state_test.cpp

@@ -0,0 +1,61 @@
+// Check production discovery policy without creating mounts or native windows.
+#include "Core/Unix/MountedFilesystem.h"
+#include "Main/VolumeSnapshot.h"
+#include <iostream>
+
+using namespace VeraCrypt;
+
+static void Require (bool condition, const char *message)
+{
+	if (!condition) throw std::runtime_error (message);
+}
+
+int main ()
+{
+	try
+	{
+		VolumeSnapshotState state;
+		using Clock = VolumeSnapshotState::Clock;
+		using std::chrono::seconds;
+		const Clock::time_point start = Clock::now();
+		Require (!state.HasSample() && !state.CanConfirmEmpty (true, start), "initial empty list was authoritative");
+		state.RecordSample (start, true);
+		Require (state.CanConfirmEmpty (true, start + seconds (1)), "fresh complete empty list ignored");
+		Require (!state.CanConfirmEmpty (false, start + seconds (1)), "nonempty list allowed auto-close");
+		Require (!state.IsFresh (start + seconds (8)) && !state.CanConfirmEmpty (true, start + seconds (8)), "stale empty list allowed auto-close");
+		state.RecordSample (start + seconds (8), true);
+		state.Invalidate();
+		Require (state.HasSample() && !state.IsFresh (start + seconds (9)) && !state.IsComplete(), "invalidated display sample remained authoritative");
+		state.RecordSample (start + seconds (10), false);
+		Require (state.IsFresh (start + seconds (11)) && !state.CanConfirmEmpty (true, start + seconds (11)), "partial inventory treated as complete absence");
+		state.RecordSample (start + seconds (12), true);
+		Require (state.HasSample() && !state.CanConfirmEmpty (true, start + seconds (18)), "slow result allowed auto-close");
+
+		MountedFilesystem mount;
+		const string prefix = ".veracrypt_aux_mnt";
+		mount.MountPoint = "/private/tmp/.veracrypt_aux_mnt-unit";
+		mount.Owner = 501;
+		for (const char *type : { "smbfs", "nfs", "macfuse", "osxfuse", "fusefs" })
+		{
+			mount.Type = type;
+			Require (mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "supported auxiliary backend ignored");
+		}
+		mount.Type = "apfs";
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "unrelated filesystem entered discovery");
+		mount.Type = "smbfs";
+		mount.MountPoint = "/private/tmp/.veracrypt_aux_mnt-parent/ordinary";
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "parent path qualified as auxiliary mount");
+		mount.MountPoint = "/private/tmp/ordinary.veracrypt_aux_mnt";
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "substring qualified as auxiliary basename");
+		mount.MountPoint = "/private/tmp/.veracrypt_aux_mnt-unit";
+		mount.Owner = 502;
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 501, 502), "another user's mount entered discovery");
+		Require (mount.IsAuxiliaryMountCandidate (prefix, 0, 502), "elevated caller lost original user's mount");
+		Require (!mount.IsAuxiliaryMountCandidate (prefix, 0, 501), "root included unrelated user's mount");
+		mount.Owner = 0;
+		Require (mount.IsAuxiliaryMountCandidate (prefix, 501, 501), "root-owned auxiliary mount ignored");
+		std::cout << "PASS: startup/partial/stale snapshot policy, auxiliary basename/backend/owner scope\n";
+	}
+	catch (std::exception &e) { std::cerr << e.what() << '\n'; return 1; }
+	return 0;
+}