v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

From AUDIT-blast-radius-hostroot-localapi-2026-07-02.md. Each fix ships with a
non-hollow test + a companion red-proof (shown failing on the pre-fix impl).
Sudoers install-source grants became globs — deploy the sudoers drop-in with
the binary. A1 (stale-lock pool-membership) deliberately excluded (spike).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/localapi/intermediary.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"path/filepath"
 	"strconv"
 	"strings"
 )
@@ -130,6 +129,26 @@ func (b *GuestBinder) EnsureSharedParent(ctx context.Context) error {
 	return nil
 }
 
+// stageTemp writes content to a fresh random-named temp file (os.CreateTemp pattern — `*` is replaced
+// by a random string) and returns its path. Caller removes it after the privileged `install`.
+func stageTemp(pattern, content string) (string, error) {
+	f, err := os.CreateTemp("", pattern)
+	if err != nil {
+		return "", err
+	}
+	name := f.Name()
+	if _, err := f.WriteString(content); err != nil {
+		f.Close()
+		os.Remove(name)
+		return "", err
+	}
+	if err := f.Close(); err != nil {
+		os.Remove(name)
+		return "", err
+	}
+	return name, nil
+}
+
 // sharedParentInstallStale reports whether the on-disk boot script OR unit is missing or differs from
 // what this build ships — the trigger to (re)install both. Comparing BOTH (not the unit alone) is the
 // F2-a fix: a script-only change must still redeploy. Pure (path args) so it is unit-testable.
@@ -144,18 +163,21 @@ func sharedParentInstallStale(unitPath, scriptPath string) bool {
 }
 
 // installSharedParentUnit writes the script + unit (from agent-written temps) and enables the unit so the
-// shared parent is re-established on every host boot before pve-guests. Idempotent.
+// shared parent is re-established on every host boot before pve-guests. Idempotent. The temps are
+// RANDOM-named os.CreateTemp files (audit B1): a fixed, predictable /tmp name could be pre-created by
+// another local user and rewritten between our write and root's install (TOCTOU into a root-executed
+// boot script). The final modes come from `install -m`, so the 0600 temps are fine.
 func (b *GuestBinder) installSharedParentUnit(ctx context.Context) error {
-	tmpScript := filepath.Join(os.TempDir(), "felhom-shared-parent.sh")
-	if err := os.WriteFile(tmpScript, []byte(sharedParentScript), 0o755); err != nil {
+	tmpScript, err := stageTemp("felhom-shared-parent-*.sh", sharedParentScript)
+	if err != nil {
 		return fmt.Errorf("write temp script: %w", err)
 	}
 	defer os.Remove(tmpScript)
 	if err := b.run(ctx, "install", "-m", "0755", "--", tmpScript, sharedParentScriptPath); err != nil {
 		return fmt.Errorf("install script: %w", err)
 	}
-	tmpUnit := filepath.Join(os.TempDir(), "felhom-shared-parent.service")
-	if err := os.WriteFile(tmpUnit, []byte(sharedParentUnit), 0o644); err != nil {
+	tmpUnit, err := stageTemp("felhom-shared-parent-*.service", sharedParentUnit)
+	if err != nil {
 		return fmt.Errorf("write temp unit: %w", err)
 	}
 	defer os.Remove(tmpUnit)