R-25 (agent half): the format answer carries the NEW filesystem's UUID, bound to the durable id

After mkfs the agent re-resolves the bound durable id, requires it to name the
device it just formatted, reads the superblock back (blkid -p, requested fstype)
and returns fs_uuid in POST /disks/format and GET /disks/format/status. Anything
unverified returns "" — never a path-resolved guess. The controller half
(mount fs_uuid instead of re-resolving the UUID from the /dev path) is owed
in felhom-controller.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/localapi/disks_test.go

@@ -28,6 +28,7 @@ type fakeDiskOps struct {
 	unmountCalls []string
 	candidates   []storage.CandidateDisk // returned by ListCandidateDisks
 	candErr      error
+	afterFormat  *storage.DeviceProbe // R-25: when set, InspectDevice returns it once a format ran
 }
 
 func (f *fakeDiskOps) ListCandidateDisks(_ context.Context) ([]storage.CandidateDisk, error) {
@@ -35,7 +36,12 @@ func (f *fakeDiskOps) ListCandidateDisks(_ context.Context) ([]storage.Candidate
 }
 
 func (f *fakeDiskOps) InspectDevice(_ context.Context, device string) (storage.DeviceProbe, error) {
+	f.mu.Lock()
 	p := f.probe
+	if f.afterFormat != nil && len(f.formatCalls) > 0 {
+		p = *f.afterFormat
+	}
+	f.mu.Unlock()
 	p.Device = device
 	return p, f.inspectErr
 }