v0.61.0: audit fixes B1 (random temp staging) + D1 (mkfs wrapper member/RO re-checks) + D2 (empty-lsblk fail-safe) + D3 (blank-format anti-retarget)

From AUDIT-blast-radius-hostroot-localapi-2026-07-02.md. Each fix ships with a
non-hollow test + a companion red-proof (shown failing on the pre-fix impl).
Sudoers install-source grants became globs — deploy the sudoers drop-in with
the binary. A1 (stale-lock pool-membership) deliberately excluded (spike).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

internal/storage/claim.go

@@ -85,6 +85,24 @@ func classifyClaim(f claimFacts) (unclaimed bool, reason string) {
 			return false, "device is mounted at " + n.mountpoint + " (" + n.name + ")"
 		}
 	}
+	// Fail-safe backstop (audit D2): a successful-but-EMPTY lsblk (or a tree that does not even contain
+	// the target whole-disk) means the member/mount loop above inspected nothing — that is undeterminable
+	// topology, not proof of freedom. Without this, "unclaimed" rested on the untested assumption that
+	// lsblk always ERRORS (non-zero exit) on a bad device rather than emitting empty success.
+	if len(f.nodes) == 0 {
+		return false, "empty block topology (undeterminable) — refusing"
+	}
+	base := path.Base(f.wholeDisk)
+	found := false
+	for _, n := range f.nodes {
+		if n.name == base {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return false, "target disk " + base + " absent from block topology (undeterminable) — refusing"
+	}
 	return true, "unclaimed"
 }