feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

Makefile

@@ -55,11 +55,17 @@ build:
 		-p init -p echo -p sleep -p snake \
 		-p display-qemu -p input-qemu -p storage-qemu \
 		-p log-server -p permission-manager -p session-server -p smptest -p spawntest -p hello \
-		-p terminal-server -p shell -p cat -p ls -p counter
+		-p terminal-server -p shell -p cat -p ls -p counter -p gatekeeper
 	cargo build --target $(RISCV_TARGET) --release -p adapter-riscv
 
+# The keystore holds the owner's sealed keys: made once, never rebuilt.
+KEYS_IMG ?= keys.img
+QEMU_KEYS = -drive file=$(KEYS_IMG),if=none,format=raw,id=ks -device virtio-blk-device,drive=ks \
+	-device virtio-rng-device
+
 image: build
 	scripts/make-disk-image.sh
+	[ -f $(KEYS_IMG) ] || truncate -s 64K $(KEYS_IMG)
 
 # Boots a test image (normal image + bin/smptest) on $(SMP) harts; init runs
 # the SMP self-test and halts. Passes only on "SMPTEST PASS".
@@ -75,13 +81,13 @@ run-disk: image
 	qemu-system-riscv64 -machine virt -smp $(SMP) -nographic -bios default \
 		-kernel $(KERNEL_BIN) \
 		-drive file=boot.img,if=none,format=raw,id=hd0 \
-		-device virtio-blk-device,drive=hd0
+		-device virtio-blk-device,drive=hd0 $(QEMU_KEYS)
 
 run-gui: image
 	qemu-system-riscv64 -machine virt -smp $(SMP) -bios default \
 		-kernel $(KERNEL_BIN) \
 		-drive file=boot.img,if=none,format=raw,id=hd0 \
-		-device virtio-blk-device,drive=hd0 \
+		-device virtio-blk-device,drive=hd0 $(QEMU_KEYS) \
 		-device virtio-gpu-device \
 		-device virtio-keyboard-device \
 		-serial stdio