feat(storage): per-app/owner/system encryption live: gatekeeper hands seed + fresh flag, storage unlocks layer, init seeds areas from factory/ (empties on new key); rmdir op; test-qemu checks sealed home + reboot persistence

scripts/make-disk-image.sh

@@ -33,11 +33,13 @@ app() {
 staged() {
     local crate="$1" folder="$2"
     if [ -f "${BUILD_DIR}/${crate}" ]; then
-        "${APP_IMAGE[@]}" stage "${ROOT}/home/${folder}" "crates/apps/${crate}/manifest.toml" "${BUILD_DIR}/${crate}"
+        "${APP_IMAGE[@]}" stage "${ROOT}/factory/home/${folder}" "crates/apps/${crate}/manifest.toml" "${BUILD_DIR}/${crate}"
     fi
 }
 
-mkdir -p "${ROOT}/bin" "${ROOT}/apps" "${ROOT}/data" "${ROOT}/system/permissions" "${ROOT}/home"
+# home/, system/ and data/ are encrypted, so not made here: init seeds them
+# from factory/ (plaintext) once the gatekeeper has the key.
+mkdir -p "${ROOT}/bin" "${ROOT}/apps" "${ROOT}/factory/home" "${ROOT}/factory/system/permissions" "${ROOT}/factory/data"
 # System servers and the shell: init starts these.
 copy display-qemu       display
 copy input-qemu         input
@@ -53,8 +55,8 @@ app ls
 app sleep
 app snake
 staged counter inbox/counter
-# The owner's files.
-cp -r disk/home/. "${ROOT}/home/"
+# The owner's first files.
+cp -r disk/home/. "${ROOT}/factory/home/"
 # Only the test image: its presence makes init run the self-test.
 if [ -n "${SMPTEST:-}" ]; then
     copy smptest   smptest