v0.54.0: format-safety foundation — unclaimed-disk guard + guarded-mkfs wrapper

Impl-1. Format now runs a mandatory unclaimed-disk guard (internal/storage/claim.go:
SystemDisks + lsblk member-FSTYPE + foreign-mount + RO + pvs/zpool; fail-safe →
CLAIMED) before any mkfs — refuses the OS disk / LVM PV / ZFS-mdraid member /
foreign-mounted device even when non-data-bearing (guard sits in Format, not the
handler). Below the agent, mkfs goes ONLY through configs/felhom-mkfs-guarded.sh
(sudoers no longer allowlists raw mkfs.*), which re-checks the catastrophic cases
as root. Read-only pvs/zpool added to FELHOM_DISK. Tests + red-proof; capability
manifest updated. go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,3 +1,32 @@
+## v0.54.0 — format-safety foundation: unclaimed-disk guard + guarded-mkfs wrapper (2026-07-01)
+
+Impl-1 (SPIKE-drive-enrollment-2026-07-01). Hardens the destructive `Format`/mkfs path BEFORE the
+enrollment feature: today `Format` delegates authorization to its caller and only checks `DataBearing`
+(has-data), which is insufficient — the OS disk is data-bearing yet catastrophic — and the sudoers
+permits `mkfs /dev/*`. Two independent, layered guards:
+
+- **Part A — mandatory unclaimed-disk guard inside `Format` (the primary safety).** New
+  `internal/storage/claim.go`: `classifyClaim` (pure) + `gatherClaimFacts` refuse to format any device
+  not provably UNCLAIMED — reusing `SystemDisks` (OS disk) + lsblk FSTYPE (LVM2_member/zfs_member/
+  linux_raid_member/crypto_LUKS/swap) + foreign mounts + read-only + authoritative `pvs`/`zpool`. A
+  Felhom-owned mount under `/mnt/felhom-drives` is NOT a foreign claim (re-init stays allowed; the
+  DataBearing wipe-confirm still gates data loss). **FAIL-SAFE: any read error / undeterminable topology
+  → CLAIMED → refuse.** The guard is in `Format` (lowest layer), not the handler, so no caller can
+  bypass it. Read-only sudoers additions: `pvs`, `zpool status` (in `FELHOM_DISK`).
+- **Part B — guarded-mkfs wrapper below the agent.** `configs/felhom-mkfs-guarded.sh` (root, 0755) is
+  now the ONLY mkfs path the sudoers allows (`FELHOM_FORMAT` no longer allowlists raw `mkfs.*`). It
+  re-checks the cheap catastrophic cases (system disk / LVM PV / foreign mount) and refuses — so even
+  an agent bug/compromise can't mkfs the OS disk. `Format` execs the wrapper (`<device> <fstype>`) via
+  `Binaries.MkfsGuarded`.
+- **Tests:** `claim_test.go` — table-driven `classifyClaim` (every claim signal + fail-safe + the two
+  allow cases) incl. the **red-proof** (a claimed, non-data-bearing OS disk: removing the isSystem check
+  flips it to allowed → test fails, proving the guard adds safety beyond `DataBearing`); Format-guard
+  integration tests (refuses system disk / LVM member, allows unclaimed → wrapper invoked); capability
+  manifest updated (mkfs sample → the wrapper). `go build`/`vet`/`test ./...` clean.
+- **Deferred to Impl-3:** a raw disk passed through to ANOTHER VM looks unused to the host — a host-level
+  filter can't detect it; the operator gate (shared-box mode) closes that. Impl-1 closes everything
+  host-visible (a strict improvement over today's no-guard state).
+
 ## v0.53.0 — restore guests INTO the felhom pool (pool-scoped-ACL enabler) (2026-07-01)
 
 Colleague-safety batch #4 phase b (agent half). Enables the agent token to be scoped from `/` to