fix(carrier): C-03 — decouple manifest re-encryption with dirty tracking and unmount flush

src/vfs.rs

@@ -788,6 +788,13 @@ impl SanctumFs {
         }
     }
 
+    pub fn sync_carrier_manifest(&self) -> Result<()> {
+        if let Some(ref cfs) = self.carrier_fs {
+            cfs.sync_manifest()?;
+        }
+        Ok(())
+    }
+
     pub fn leak_count(&self) -> u64 {
         self.leak_counter().load(Ordering::Relaxed)
     }