feat(boot): gatekeeper gates boot (init→UI→gatekeeper→data); keystore disk + virtio-rng discovery; terminal READ_SECRET; storage SET_KEY; PageCount ≤8192, alloc cap gone; device window 0x01D0_0000; test-qemu types passcode over 2 boots

docs/ipc.md

@@ -91,6 +91,17 @@ and budget listed there. Storage, started before the log server, receives
 its log endpoint from init later (`SET_LOG`, accepted only from the
 unbadged holder of its endpoint).
 
+Nothing that touches user data starts before the owner is authenticated.
+Init starts the log, input, display and terminal servers, then the
+gatekeeper (`types::gatekeeper`), handing it only the terminal, the keystore
+(a small disk of its own, told from the data disk by its size) and the
+virtio-rng device. Init calls `UNLOCK`, which returns once the owner is in,
+then `KEY`, whose reply is the master key; init passes it to storage
+(`SET_KEY`, from the unbadged holder only, each half once) and only then
+starts the permission manager and the desktop. If the gatekeeper cannot
+unlock, init stops there. The gatekeeper exits, and its capabilities go
+with it.
+
 A program's `uses` endpoints arrive as badged copies with `Execute` and
 `Delegate`: the badge (unique per copy) tells the server which client is
 calling, and `Delegate` lets the client send capabilities with its calls