fix: narrow vfs.Opener interface from ReadWriteCloser to ReadCloser

All callers only read from the opened file (io.ReadAll + Close). Using
io.ReadWriteCloser in the interface was misleading and violated the
principle of interface segregation. os.Open returns a read-only file
that satisfies io.ReadCloser but not the write contract implied by
io.ReadWriteCloser. Narrow both the interface and the implementation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vfs/vfs.go

@@ -6,13 +6,13 @@ import (
 )
 
 type Opener interface {
-	Open(name string) (io.ReadWriteCloser, error)
+	Open(name string) (io.ReadCloser, error)
 }
 
 type LocalOSOpener struct {
 }
 
-func (o LocalOSOpener) Open(name string) (io.ReadWriteCloser, error) {
+func (o LocalOSOpener) Open(name string) (io.ReadCloser, error) {
 	return os.Open(name)
 }