feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

crates/servers/terminal-server/src/tests/server.rs

@@ -176,3 +176,13 @@ fn rows_are_drawn_only_as_wide_as_their_text_or_what_it_replaces() {
     // Cleared: the old five cells and the cursor after them are erased.
     assert!(t.console().rows_drawn.contains(&(0, 6)), "{:?}", t.console().rows_drawn);
 }
+
+#[test]
+fn a_secret_line_shows_stars_and_is_forgotten() {
+    let mut t = term(b"hunter2\n");
+    let (words, _) = t.handle_call(1, [types::terminal::READ_SECRET, 0, 0, 0], None);
+    let (bytes, len) = text_of(words).unwrap();
+    assert_eq!(&bytes[..len], b"hunter2\n");
+    assert_eq!(&t.grid().row(0)[..8], b"*******\x20");
+    assert!(!t.grid().row(0).windows(7).any(|w| w == b"hunter2"));
+}