v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

From AUDIT-blast-radius-hostroot-localapi-2026-07-02.md. Each fix ships with a
non-hollow test + a companion red-proof (shown failing on the pre-fix impl).
Sudoers install-source grants became globs — deploy the sudoers drop-in with
the binary. A1 (stale-lock pool-membership) deliberately excluded (spike).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/localapi/server.go

@@ -186,6 +186,11 @@ type Server struct {
 	// override it to avoid touching real /dev.
 	reresolveWipe func(ctx context.Context, durableID string) (string, error)
 
+	// reresolveBlank is the BLANK-format sibling (audit D3): same anti-retarget
+	// sequence, but requires the re-inspected device to STILL be blank. Defaults
+	// to s.reresolveDurableForBlankFormat; tests override it.
+	reresolveBlank func(ctx context.Context, durableID string) (string, error)
+
 	// deviceDurableID derives the WIPE-binding durable id of a block device (the byid:/byuuid: scheme
 	// the wipe gate resolves against). F20-BUG2: BOTH the /disks list (DiskInfo.WipeDurableID) and the
 	// format gate use this single seam, so the id the customer copies from the list is exactly the id
@@ -253,6 +258,7 @@ func NewServer(o Options) (*Server, error) {
 		swapInFlight: map[int]bool{},
 	}
 	s.reresolveWipe = s.reresolveDurableForWipe
+	s.reresolveBlank = s.reresolveDurableForBlankFormat
 	s.deviceDurableID = storage.DeviceDurableID
 	if o.ControllerSwap != nil {
 		s.swap = NewControllerSwapper(o.ControllerSwap, o.ControllerSwapStateDir, o.Logger)