feat(storage): per-app/owner/system encryption live: gatekeeper hands seed + fresh flag, storage unlocks layer, init seeds areas from factory/ (empties on new key); rmdir op; test-qemu checks sealed home + reboot persistence

crates/types/src/gatekeeper.rs

@@ -1,11 +1,15 @@
 //! Init and the gatekeeper: after handing it the keystore and randomness
 //! (device setup calls), init calls `UNLOCK`, which returns once the owner
-//! is authenticated (`OK`) or the gatekeeper cannot go on (`FAILED`); then
-//! `KEY`, whose reply is the 32-byte master key in its four words. The
-//! gatekeeper then exits. Only the unbadged holder (init) is answered.
+//! is authenticated (`OK`, word 1 non-zero if the master key is new: a
+//! fresh device or one just wiped) or the gatekeeper cannot go on
+//! (`FAILED`); then `KEY`, whose reply is the 32-byte master key in its four
+//! words, and `SEED`, 32 fresh random bytes from the hardware for storage's
+//! randomness this boot. The gatekeeper then exits. Only the unbadged
+//! holder (init) is answered.
 
 pub const UNLOCK: usize = 1;
 pub const KEY: usize = 2;
+pub const SEED: usize = 3;
 
 pub mod reply {
     pub const OK: usize = 0;

crates/types/src/storage.rs

@@ -36,6 +36,11 @@ pub mod op {
     /// Half the master key (word 1: which half, words 2..4: it), from the
     /// unbadged holder (init) only, each half once.
     pub const SET_KEY: usize = 13;
+    /// Half the seed for storage's randomness this boot, as `SET_KEY`. The
+    /// encrypted areas open once the whole key and seed are in.
+    pub const SET_SEED: usize = 14;
+    /// Removes the (empty) directory at the path in the buffer.
+    pub const RMDIR: usize = 15;
 }
 
 /// Reply tags (word 0).