feat(storage): ext4-only disk via mkfs.ext4 -d; drop FAT16; feature-gated mount (ro on unknown ro_compat); ext4 read spans blocks, delete clears inode, mkdir counts dir; virtio-blk writes; test-qemu e2fsck gate

docs/ipc.md

@@ -76,7 +76,10 @@ A thread made by `SpawnThread`/`SpawnThreadIn` starts with the caller's
 `arg` in `a0`. A process's first thread reads it as `types::start_arg`:
 the slots of the console and log capabilities it was handed.
 
-Boot loads only init and storage (init needs it to read anything else):
+Boot loads only init and storage, both packed into the kernel image (they
+are what reads the disk, so they cannot come from it). The disk is one ext4
+filesystem; storage refuses one with features it does not understand, and
+mounts read-only one it could not keep consistent.
 init gets storage's process and endpoint in slots 1 and 2, before the
 board capabilities. Everything else init starts from its manifest
 (`init/src/manifest.rs`), handing each program only the endpoints, device