feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

crates/servers/storage-server/src/tests/protocol.rs

@@ -25,6 +25,7 @@ fn every_request_roundtrips() {
             write: false,
         },
         StorageRequest::Release,
+        StorageRequest::SetKey { half: 1, words: [7, 9] },
     ] {
         assert_eq!(StorageRequest::decode(req.encode()), Some(req));
     }

crates/servers/storage-server/src/tests/server.rs

@@ -472,3 +472,16 @@ fn the_unbadged_holder_cannot_be_released() {
         StorageResponse::Error
     );
 }
+
+#[test]
+fn only_init_sets_the_key_and_only_once() {
+    let mut s = server();
+    let set = |s: &mut Srv, badge, half| call(s, badge, StorageRequest::SetKey { half, words: [1, 2] }).0;
+    assert_eq!(set(&mut s, 5, 0), StorageResponse::Error, "a client cannot");
+    assert_eq!(set(&mut s, 0, 0), StorageResponse::Ok);
+    assert!(!s.unlocked());
+    assert_eq!(set(&mut s, 0, 0), StorageResponse::Error, "nor can it be replaced");
+    assert_eq!(set(&mut s, 0, 2), StorageResponse::Error, "two halves only");
+    assert_eq!(set(&mut s, 0, 1), StorageResponse::Ok);
+    assert!(s.unlocked());
+}