v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

From AUDIT-blast-radius-hostroot-localapi-2026-07-02.md. Each fix ships with a
non-hollow test + a companion red-proof (shown failing on the pre-fix impl).
Sudoers install-source grants became globs — deploy the sudoers drop-in with
the binary. A1 (stale-lock pool-membership) deliberately excluded (spike).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/localapi/disks_test.go

@@ -103,6 +103,13 @@ func sysOnSDA() fakeHostReader {
 
 // newDiskServer builds a server wired with the 8C disk deps (token A → guest 8200).
 func newDiskServer(t *testing.T, d *fakeDiskOps, g *fakeGate, sv StorageView, gl GuestLister) http.Handler {
+	t.Helper()
+	return newDiskServerRaw(t, d, g, sv, gl).Handler()
+}
+
+// newDiskServerRaw is newDiskServer returning the *Server, so tests can override seams
+// (reresolveWipe/reresolveBlank/deviceDurableID) before taking the handler.
+func newDiskServerRaw(t *testing.T, d *fakeDiskOps, g *fakeGate, sv StorageView, gl GuestLister) *Server {
 	t.Helper()
 	if sv == nil {
 		sv = fakeStorage{}
@@ -129,10 +136,13 @@ func newDiskServer(t *testing.T, d *fakeDiskOps, g *fakeGate, sv StorageView, gl
 	// device the format tests use; antiRetargetResolve itself is covered directly
 	// in wipe_reresolve_test.go.
 	srv.reresolveWipe = func(_ context.Context, _ string) (string, error) { return "/dev/sdb", nil }
+	// [audit D3] the blank-path anti-retarget sibling touches /dev/disk/by-* too; stub it to a
+	// successful still-blank re-resolve of the same device. Covered directly in wipe_reresolve_test.go.
+	srv.reresolveBlank = func(_ context.Context, _ string) (string, error) { return "/dev/sdb", nil }
 	// F20-BUG2: the wipe id derivation hits /dev/disk/by-* in production; stub it deterministically so
 	// both the /disks list and the gate (which share this seam) resolve the same id in tests.
 	srv.deviceDurableID = func(device string) (string, error) { return "byid:wwn-" + strings.TrimPrefix(device, "/dev/"), nil }
-	return srv.Handler()
+	return srv
 }
 
 // ---- the security centerpiece -----------------------------------------------------------