feat: add storage directory mode and removal flags

`storage:create` and `storage:set` accept a `--mode` flag that sets the octal permissions of a docker-local host directory, and `storage:destroy` accepts a `--destroy-host-dir` flag that removes the directory along with its contents. A docker-local entry also honors `--reclaim-policy Delete` at destroy time now, matching how that policy governs a k3s PersistentVolume. Both are limited to the default `/var/lib/dokku/data/storage/<name>` location, the same restriction `--chown` already carries. `storage:set` applies `--chown` and `--mode` to the directory rather than only recording them.

plugins/storage/storage.go

@@ -3,6 +3,7 @@ package storage
 import (
 	"errors"
 	"fmt"
+	"path/filepath"
 	"regexp"
 	"strings"
 
@@ -189,6 +190,50 @@ func GetStorageDirectory() string {
 	return fmt.Sprintf("%s/data/storage", dokkuLibRoot)
 }
 
+// storageDirScriptNames lists the sudo helpers shipped in the plugin's bin
+// directory. Each one takes a storage entry basename and builds the path
+// under $DOKKU_LIB_ROOT/data/storage itself, so no caller can point them
+// outside the storage root.
+var storageDirScriptNames = []string{
+	"chown-storage-dir",
+	"chmod-storage-dir",
+	"destroy-storage-dir",
+}
+
+// StorageDirScriptPath returns the absolute path to a storage directory
+// sudo helper.
+func StorageDirScriptPath(name string) string {
+	pluginPath := common.MustGetEnv("PLUGIN_AVAILABLE_PATH")
+	return filepath.Join(pluginPath, "storage", "bin", name)
+}
+
+// StorageDirScripts returns the absolute path of every storage directory
+// sudo helper. TriggerInstall whitelists each one in the plugin's sudoers
+// file.
+func StorageDirScripts() []string {
+	paths := []string{}
+	for _, name := range storageDirScriptNames {
+		paths = append(paths, StorageDirScriptPath(name))
+	}
+	return paths
+}
+
+// callStorageDirScript runs a storage directory sudo helper, surfacing the
+// helper's own stderr message when it refuses the arguments.
+func callStorageDirScript(name string, args ...string) error {
+	result, err := common.CallExecCommand(common.ExecCommandInput{
+		Command: "sudo",
+		Args:    append([]string{StorageDirScriptPath(name)}, args...),
+	})
+	if err != nil {
+		return err
+	}
+	if result.ExitCode != 0 {
+		return errors.New(strings.TrimSpace(result.StderrContents()))
+	}
+	return nil
+}
+
 // ValidateDirectoryName validates a storage directory name
 func ValidateDirectoryName(directory string) error {
 	if directory == "" {