R-25 (agent half): the format answer carries the NEW filesystem's UUID, bound to the durable id

After mkfs the agent re-resolves the bound durable id, requires it to name the
device it just formatted, reads the superblock back (blkid -p, requested fstype)
and returns fs_uuid in POST /disks/format and GET /disks/format/status. Anything
unverified returns "" — never a path-resolved guess. The controller half
(mount fs_uuid instead of re-resolving the UUID from the /dev path) is owed
in felhom-controller.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/storage/hostops_disk_test.go

@@ -208,3 +208,17 @@ func TestFormat_RejectsBadArgs(t *testing.T) {
 		t.Fatalf("mkfs ran despite invalid input: %v", r.calls)
 	}
 }
+
+// R-25: the probe carries the superblock's filesystem UUID so the format path can report the new one.
+func TestInspect_ReadsFilesystemUUID(t *testing.T) {
+	r := &scriptedRunner{
+		outputs: map[string][]byte{
+			"blkid": []byte("DEVNAME=/dev/sdb\nUUID=0fc63daf-8483-4772-8e79-3d69d8477de4\nTYPE=ext4\nUSAGE=filesystem\n"),
+			"lsblk": []byte(`{"blockdevices":[{"name":"sdb","fstype":"ext4","pttype":null,"mountpoint":null}]}`),
+		},
+	}
+	p, _ := newSudo(r).InspectDevice(context.Background(), "/dev/sdb")
+	if p.FSUUID != "0fc63daf-8483-4772-8e79-3d69d8477de4" {
+		t.Fatalf("FSUUID = %q, want the blkid UUID", p.FSUUID)
+	}
+}