v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

From AUDIT-blast-radius-hostroot-localapi-2026-07-02.md. Each fix ships with a
non-hollow test + a companion red-proof (shown failing on the pre-fix impl).
Sudoers install-source grants became globs — deploy the sudoers drop-in with
the binary. A1 (stale-lock pool-membership) deliberately excluded (spike).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/guesthook/install.go

@@ -36,12 +36,23 @@ exec ` + AgentBin + ` guest-hook "$1" "$2"
 // InstallSnippet writes the pre-start hook wrapper into the PVE snippets dir (idempotent, root-owned,
 // executable). The agent runs as a non-root service user, so it writes an agent-writable temp file then
 // `install`s it host-root (same pattern as the bootstrap mount + dnsmasq drop-ins). Safe to call repeatedly.
+// The temp file is a RANDOM-named os.CreateTemp (audit B1): a fixed, predictable /tmp name could be
+// pre-created by another local user and rewritten between our write and root's install (TOCTOU into a
+// root-executed hookscript). The final mode comes from `install -m`, so the 0600 temp is fine.
 func InstallSnippet(ctx context.Context, runner proxmox.Runner) error {
-	tmp := filepath.Join(os.TempDir(), "felhom-guest-hook.sh")
-	if err := os.WriteFile(tmp, []byte(snippetBody), 0o755); err != nil {
+	f, err := os.CreateTemp("", "felhom-guest-hook-*.sh")
+	if err != nil {
+		return fmt.Errorf("guesthook: create temp snippet: %w", err)
+	}
+	tmp := f.Name()
+	defer os.Remove(tmp)
+	if _, err := f.WriteString(snippetBody); err != nil {
+		f.Close()
 		return fmt.Errorf("guesthook: write temp snippet: %w", err)
 	}
-	defer os.Remove(tmp)
+	if err := f.Close(); err != nil {
+		return fmt.Errorf("guesthook: close temp snippet: %w", err)
+	}
 	if _, stderr, err := runner.Run(ctx, "install", "-m", "0755", "--", tmp, SnippetPath); err != nil {
 		return fmt.Errorf("guesthook: install snippet to %s: %w: %s", SnippetPath, err, string(stderr))
 	}