Alpha.11 state resize recovery and persistent recovery credential truth

[Deadbytes101]

Purpose

Fix the physical alpha.10 failures tracked by #24 and #25:

• the verified USB state partition was grown, but the core 20-second command budget killed resize2fs
• the resulting command timeout was misreported as limited_capacity
• recovery access then wrote the password hash into the live overlay under /var/lib/rigos and falsely reported it persistent, so reboot prompted for a new password

Changes

• advance the next immutable artifact to 0.0.4-alpha.11
• keep the core fail-closed path, but detect the exact verified resize2fs: timeout result in the state orchestrator
• revalidate the current boot attestation and unmounted ext4 state identity
• run a forced ext4 check and resize2fs under a bounded 300-second repair budget
• rerun the normal state core after successful completion so mount, labeling, state identity, and layout initialization remain authoritative
• report unrecovered filesystem work as repair_required, not capacity failure
• allow the state service a bounded 12-minute total startup window
• persist the rigosadmin password hash only when /var/lib/rigos is the current verified persistent mount
• otherwise expose an explicit boot-scoped credential and never claim or attempt persistence
• keep diagnostic SSH available while configuration and mining remain fail-closed
• add behavioral source tests and a read-only exact-image verifier

Safety boundary

No internal disk targeting is added. Repair commands operate only on the current boot-attested USB state PARTUUID after identity and unmounted-state verification. Boot-scoped credentials never write into unverified state.

Stacked relationship

This draft is based on fix/alpha10-diagnostic-ssh. It must remain unmerged until exact-head source verification, alpha.11 exact-image verification, physical state recovery, password restore after reboot, persistent SSH host identity, and miner/configuration activation all pass.

[Deadbytes101]

Implementation is now at exact head 6a11d1c3d4e978e7959a0e2950c05cf1f440194b.

Physical evidence driving this patch:

• USB disk: 15,550,382,080 bytes
• state partition: 13,133,414,400 bytes
• state outcome: limited_capacity
• actual failure: bounded command failed: resize2fs: timeout
• reboot prompted for another password because the previous hash had been written only into the live overlay

Implemented boundaries:

• verified state PARTUUID only
• device must be unmounted ext4 with the attested label/identity
• forced e2fsck plus resize2fs use a bounded 300-second repair budget
• repeated/incomplete repair becomes repair_required
• recovery password persistence requires the current verified /var/lib/rigos mount
• unavailable state uses explicit credential_scope=boot, credential_persisted=false
• diagnostic SSH remains available; profile/miner remain fail-closed
• new source behavioral tests and read-only exact-image verifier

Source gate and alpha.11 image build are still pending. Keep this PR draft and unmerged.

[Deadbytes101]

Exact-head Alpha.11 source verification passed locally.

Verified head:

5d9e5b2e91783a57a51d6802d7d269f9428e92e7

Observed gates:

• full workspace tests and doc tests passed
• recovery credential scope tests passed for both persistent and boot-scoped truth
• diagnostic SSH source tests passed
• firstboot/source image-gate wiring tests passed
• state resize recovery tests passed
• systemd ordering verification passed
• RIGOS verification passed
• RIGOS firstboot theme wrapper verification passed
• RIGOS_WSL_SOURCE_GATE=PASS

This is source evidence only. PR remains draft and unmerged pending Alpha.11 exact-image construction and physical validation of state recovery, password restoration across reboot, persistent SSH identity, configuration activation, and miner startup.

[Deadbytes101]

Physical Alpha.11 validation failed at the state-recovery gate on exact release commit 15f1a2c0476d00724fc9054347de268d2a9d1162 and image SHA-256 7870c2c74e9edf64c58372b39fa15db10fe9ad5b605a26d638ea36d87df8d1dd.

Observed after boot:

• state outcome: repair_required
• failure: post-timeout ext4 check failed: e2fsck: exit 4: ... UNEXPECTED INCONSISTENCY; RUN fsck MANUALLY.
• /var/lib/rigos remained the live overlay
• recovery credential remained truthful boot scope with credential_persisted=false
• SSH identity remained ephemeral
• profile and miner remained blocked
• reboot therefore requested a new boot-scoped password again

This confirms the Alpha.11 password behavior is downstream of unresolved state repair, not a false persistence claim. Follow-up is tracked by #27 and draft PR #28. Keep Alpha.11 unmerged and do not promote its image.