fix(build): image checks cannot pass on a stale stick; mkartemis refuses bad numbers and reads its format back

Review of the stick's increment 3 (a4221d8b..c416c805), on Captain Bob's word:

- check_images.sh deletes both images before building and makes each build a
  check: a failed build left last run's lithos-pc.img in place, and every stick
  check passed against it.
- mkartemis takes --first-lba and --sectors as plain decimal numbers only:
  "abc", "-2", "2048x" and the like formatted at LBA 0, over the GPT.
- mkartemis --format reopens the image read-only and reads the volume back:
  blk_commit_format ignores its own write errors, so a header that never
  landed was reported formatted. The header is read from the disk and judged
  as attach judges it (magic, version 2, BAM size); blk_get_volume_meta gives
  the in-memory geometry of a blank disk, magic included, so --check no longer
  relies on it either.

check_images.sh keeps each case as a check (40, PASS). stick_boot and datastick
on amd64/aarch64/riscv64 PASS on the rebuilt tools.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/check_images.sh

@@ -64,8 +64,10 @@ artemis_check() {   # artemis_check IMG N -- mkartemis --check on partition N
 uuid() { artemis_check "$1" "$2" 2>/dev/null | sed -n 's/.*disk_uuid \([0-9a-f]*\).*/\1/p'; }
 
 echo "== building"
-make boot_image TARGET=PC >/dev/null 2>&1; echo "boot_image exit $?"
-make -f kernel/Makefile ARCH=amd64 datastick >/dev/null 2>&1; echo "datastick exit $?"
+# no image from an earlier run may stand in for one this run failed to build
+rm -f "$STICK" "$DATA"
+check "the stick builds (make boot_image TARGET=PC)" make boot_image TARGET=PC
+check "the data stick builds (make datastick)" make -f kernel/Makefile ARCH=amd64 datastick
 
 echo "== the stick ($STICK)"
 check "it exists, 2048 MiB" eq "$(stat -c %s "$STICK" 2>/dev/null)" "$((2048 * 1048576))"
@@ -92,10 +94,42 @@ check "sfdisk --verify: the GPT is clean" sfdisk --verify "$DATA"
 check "the identity partition is all zeros" zeros "$DATA" 1
 check "Artemis: STFR v2, signature ok" artemis_check "$DATA" 2
 U1=$(uuid "$DATA" 2)
-make -f kernel/Makefile ARCH=amd64 datastick >/dev/null 2>&1
+check "the data stick builds again" make -f kernel/Makefile ARCH=amd64 datastick
 U2=$(uuid "$DATA" 2)
 check "made again, it is fresh: its own disk_uuid ($U1 / $U2)" test -n "$U1" -a -n "$U2" -a "$U1" != "$U2"
 
+echo "== mkartemis refuses what it cannot do safely"
+T=build/amd64/kernel/tools/check-images; mkdir -p "$T"
+fresh() { rm -f "$T/t.img"; truncate -s 64M "$T/t.img"; }
+untouched() { cmp -s -n $((64 * 1048576)) "$T/t.img" /dev/zero; }
+refused() { ! "$MKARTEMIS" --format "$T/t.img" --first-lba "$1" --sectors "$2" && untouched; }
+for bad in abc "" -2 2048x " 2048" +2048 99999999999999999999999; do
+    fresh; check "--first-lba '$bad' refused, nothing written" refused "$bad" 63488
+    fresh; check "--sectors '$bad' refused, nothing written" refused 2048 "$bad"
+done
+# a header write that does not land: --format reads the volume back and fails
+cat > "$T/failhdr.c" <<'SHIM'
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+ssize_t pwrite(int fd, const void *b, size_t n, off_t off)
+{
+    static ssize_t (*real)(int, const void *, size_t, off_t);
+    const char *at = getenv("FAIL_AT");
+    if (!real) real = (ssize_t (*)(int, const void *, size_t, off_t))dlsym(RTLD_NEXT, "pwrite");
+    if (at && off == (off_t)strtoll(at, NULL, 10)) { errno = EIO; return -1; }
+    return real(fd, b, n, off);
+}
+SHIM
+cc -shared -fPIC -o "$T/failhdr.so" "$T/failhdr.c" -ldl
+fresh
+check "a header write that fails, fails --format" eval '! FAIL_AT=$((2048 * 512)) LD_PRELOAD="$T/failhdr.so" "$MKARTEMIS" --format "$T/t.img" --first-lba 2048 --sectors 63488'
+fresh
+check "a good format reads back" "$MKARTEMIS" --format "$T/t.img" --first-lba 2048 --sectors 63488
+rm -f "$T/t.img"
+
 # the builds regenerate these; put them back as committed (as qemu_session.py does)
 git checkout -q -- v3/include/version.h capsules/BLOCK_MAP.md sbom.spdx sbom.spdx.json