Check permissions and length in fake os.truncate and os.ftruncate

[kratos0718]

Describe the changes

• os.truncate() on a read-only file succeeded and emptied it; the real call raises EACCES (checked with is_root() like the other permission checks).
• os.ftruncate() on a descriptor opened with O_RDONLY truncated the file; POSIX raises EINVAL. Left unchanged under Windows, where I could not check the real behavior.
• a negative length raised ENOSPC from the size setter; both calls raise EINVAL. os.truncate(fd, ...) now goes through ftruncate, so it gets the same checks.

The new tests also run against the real fs (TEST_REAL_FS=1 passes on macOS and as a non-root user on Linux), and they fail without the change.

Tasks

• Unit tests added that reproduce the issue or prove feature is working
• Fix or feature added
• Entry to release notes added
• Pre-commit CI shows no errors
• Unit tests passing
• For documentation changes: The Read the Docs preview builds and looks as expected

[davidlbaird]

Please add an issue so that this change can be tracked in CHANGES.md.