v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

From AUDIT-blast-radius-hostroot-localapi-2026-07-02.md. Each fix ships with a
non-hollow test + a companion red-proof (shown failing on the pre-fix impl).
Sudoers install-source grants became globs — deploy the sudoers drop-in with
the binary. A1 (stale-lock pool-membership) deliberately excluded (spike).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

configs/felhom-agent.sudoers

@@ -68,9 +68,11 @@ Cmnd_Alias FELHOM_DNSMASQ = \
 # wrapper is installed once into the PVE snippets dir (from an agent-written /tmp file) and registered
 # per-guest; decommission/eject DELETE the dead mountpoint slot so a missing bind source can't brick the
 # guest at next boot (the B3 C1 fix). The agent fine-validates the vmid (numeric) + slot (mp[0-9]+) and
-# the snippet path is fixed — the wildcards are the coarse allowlist.
+# the snippet path is fixed — the wildcards are the coarse allowlist. The install SOURCE is a
+# random-named agent temp (os.CreateTemp, audit B1 — a fixed /tmp name was a local TOCTOU), hence the
+# glob; the DESTINATION stays pinned.
 Cmnd_Alias FELHOM_GUESTHOOK = \
-  /usr/bin/install -m 0755 -- /tmp/felhom-guest-hook.sh /var/lib/vz/snippets/felhom-guest-hook.sh, \
+  /usr/bin/install -m 0755 -- /tmp/felhom-guest-hook-*.sh /var/lib/vz/snippets/felhom-guest-hook.sh, \
   /usr/sbin/pct set [0-9]* --hookscript local\:snippets/felhom-guest-hook.sh, \
   /usr/sbin/pct set [0-9]* --delete mp[0-9]*, \
   /usr/sbin/pct reboot [0-9]*
@@ -95,8 +97,8 @@ Cmnd_Alias FELHOM_INTERMEDIARY = \
   /usr/bin/mount --make-private /mnt/felhom-drives, \
   /usr/bin/mount --bind /mnt/*/felhom-data /mnt/felhom-drives/*, \
   /usr/bin/umount /mnt/felhom-drives/*, \
-  /usr/bin/install -m 0755 -- /tmp/felhom-shared-parent.sh /usr/local/sbin/felhom-shared-parent.sh, \
-  /usr/bin/install -m 0644 -- /tmp/felhom-shared-parent.service /etc/systemd/system/felhom-shared-parent.service, \
+  /usr/bin/install -m 0755 -- /tmp/felhom-shared-parent-*.sh /usr/local/sbin/felhom-shared-parent.sh, \
+  /usr/bin/install -m 0644 -- /tmp/felhom-shared-parent-*.service /etc/systemd/system/felhom-shared-parent.service, \
   /usr/bin/systemctl enable felhom-shared-parent.service, \
   /usr/bin/lxc-info -n [0-9]* -p -H, \
   /usr/sbin/pct set [0-9]* -mp8 /mnt/felhom-drives*

configs/felhom-mkfs-guarded.sh

@@ -3,7 +3,8 @@
 # felhom-mkfs-guarded — the ONLY mkfs path the felhom-agent sudoers permits (Impl-1 Part B,
 # SPIKE-drive-enrollment-2026-07-01 §SQ3). Defense-in-depth BELOW the agent: even a buggy or
 # compromised agent cannot mkfs a catastrophic target through this — it re-checks, as root, the
-# cheap catastrophic cases (OS/system disk, LVM physical volume, a foreign mount) and refuses.
+# cheap catastrophic cases (OS/system disk, LVM physical volume, a foreign mount, a read-only
+# device, and any LVM/ZFS/mdraid/LUKS/swap member signature — audit D1) and refuses.
 #
 # The agent's full unclaimed-disk filter (internal/storage/claim.go) is the PRIMARY guard; this
 # wrapper is a deliberately minimal, auditable second gate. It is NOT the place for the full filter.
@@ -38,14 +39,21 @@ while read -r src mnt _rest; do
   esac
 done < /proc/mounts
 
-# 2) LVM physical volume anywhere on the target disk or its partitions.
-if command -v pvs >/dev/null 2>&1; then
+# 2) LVM physical volume anywhere on the target disk or its partitions. pvs is resolved by ABSOLUTE
+#    path (audit D1: `command -v pvs` silently skipped this check when pvs wasn't on the caller's
+#    PATH); if neither candidate exists, check 5's LVM2_member FSTYPE loop still catches a PV
+#    independently — pvs-absent never silently drops LVM detection.
+pvsbin=""
+for c in /usr/sbin/pvs /sbin/pvs; do
+  [[ -x "$c" ]] && { pvsbin="$c"; break; }
+done
+if [[ -n "$pvsbin" ]]; then
   while read -r pv; do
     pv="${pv//[[:space:]]/}"; [[ -z "$pv" ]] && continue
     pvpk="$(lsblk -ndo PKNAME "$pv" 2>/dev/null || true)"
     pvwhole="$pv"; [[ -n "$pvpk" ]] && pvwhole="/dev/$pvpk"
     [[ "$pvwhole" == "$whole" ]] && die "device holds an LVM physical volume ($pv)"
-  done < <(pvs --noheadings -o pv_name 2>/dev/null || true)
+  done < <("$pvsbin" --noheadings -o pv_name 2>/dev/null || true)
 fi
 
 # 3) mounted OUTSIDE Felhom's own drive area = a live foreign filesystem → catastrophic. Mounts under
@@ -58,6 +66,26 @@ while read -r mp; do
   esac
 done < <(lsblk -nro MOUNTPOINT "$whole" 2>/dev/null || true)
 
+# 4) read-only device (audit D1): a device the kernel marks RO is never a formattable data disk.
+wbase="${whole#/dev/}"
+rof="/sys/block/$wbase/ro"
+if [[ -r "$rof" ]]; then
+  ro="$(cat "$rof" 2>/dev/null || true)"
+  [[ "$ro" == "1" ]] && die "read-only device ($whole)"
+fi
+
+# 5) member/active FSTYPEs anywhere on the target disk or its partitions (audit D1). Mirrors
+#    claim.go memberFSTypes exactly: a member of LVM/ZFS/mdraid/LUKS or active-swap signature is
+#    always a claim, never a plain formattable data disk. This also independently catches an LVM PV
+#    when pvs is not installed (check 2's belt-and-suspenders).
+while read -r fst; do
+  [[ -z "$fst" ]] && continue
+  case "$fst" in
+    LVM2_member|zfs_member|linux_raid_member|crypto_LUKS|swap)
+      die "device holds a $fst signature ($whole)" ;;
+  esac
+done < <(lsblk -nro FSTYPE "$whole" 2>/dev/null || true)
+
 # Passed the catastrophic checks → format. exec so the mkfs exit status is the wrapper's.
 case "$fstype" in
   ext4) exec /usr/sbin/mkfs.ext4 -F "$dev" ;;