feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

crates/servers/gatekeeper/src/flow.rs

@@ -57,6 +57,8 @@ impl Drop for Secret {
 /// The owner, on the screen and keyboard.
 pub trait Prompt {
     fn say(&mut self, text: &str);
+    /// Blanks the screen.
+    fn clear(&mut self);
     /// Shows `question` and reads a passcode without showing it; false if
     /// nothing could be read.
     fn secret(&mut self, question: &str, out: &mut Secret) -> bool;
@@ -128,6 +130,8 @@ fn choose(prompt: &mut impl Prompt, question: &str, optional: bool, out: &mut Se
 /// A device never set up (or wiped): the owner chooses a passcode, and
 /// may choose a duress one. Returns the new master key.
 fn setup(ks: &mut impl Keystore, rng: &mut impl Random, prompt: &mut impl Prompt, params: KdfParams, memory: &mut [Block]) -> Result<Key, Failure> {
+    // After a wipe nothing earlier may show: it must look like a new device.
+    prompt.clear();
     prompt.say("This device has no passcode yet. Choose one; it protects everything on it.\n");
     let mut real = Secret::new();
     choose(prompt, "New passcode: ", false, &mut real)?;