pub(crate) fn ensure_composefs_dir(physical_root: &Dir) -> Result<()>
Ensure the composefs directory exists in the given physical root with the correct permissions (mode 0700).