Fix silent disk overwrite of unrecognized Artemis disks

The generic block subsystem (blk_format_or_load_disk) auto-reformatted
any disk lacking its own low-level 'STFR' header at attach time, before
Artemis's Forth-level BLANK/LithosAnanke/Unrecognized classification
ever ran -- so ART-HALT-UNRECOG's "Disk preserved" message was false.

Split detection from commit: an unrecognized/blank disk is now left
PROVISIONAL (geometry computed in memory only, all writes refused)
until explicitly confirmed via the new blk_subsys_confirm_format() /
BLK-CONFIRM-FORMAT primitive. Artemis calls it from ART-FORMAT and
ART-RESUME, never from ART-HALT-UNRECOG.

Verified on amd64/aarch64/riscv64: parity intact (identical dict_hash),
normal recognized-disk resume + persist-read unaffected, and a
regenerated disk/artemis-unrecognized-test.img (the old copy had itself
been silently corrupted by this exact bug) now stays byte-for-byte
identical across a halted boot on amd64 and riscv64.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

include/block_subsystem.h

@@ -210,6 +210,16 @@ typedef struct {
     uint8_t dirty;     /* 1=UPDATE called; content needs flush */
 } blk_bam_entry_t;
 
+/* Low-level disk container format state. This is distinct from — and known
+ * nothing about — any higher-level content classification (e.g. Artemis's
+ * own BLANK/LithosAnanke/Unrecognized marker check). A slot stays
+ * PROVISIONAL, and all writes to it are refused, until its owner explicitly
+ * calls blk_subsys_confirm_format() after deciding the disk is safe to
+ * touch. This is what makes "halt, disk preserved" actually true instead
+ * of being overwritten by this layer's own opportunistic reformat before
+ * the owner ever gets a look. */
+enum { BLK_FMT_FORMATTED = 0, BLK_FMT_PROVISIONAL = 1 };
+
 /* ===== Public API ===== */
 int blk_subsys_init(VM *vm, uint8_t *ram_base, size_t ram_size);
 
@@ -247,6 +257,11 @@ int blk_allocate(uint32_t * block_num);
 
 int blk_subsys_add_raw_device(uint8_t *buf, uint32_t nblocks);
 
+/* Commit the low-level format (write header + BAM) for the disk slot that
+ * owns lbn. No-op (returns BLK_OK) if already FORMATTED. Must be called
+ * by the disk's owner before any write to that slot will succeed. */
+int blk_subsys_confirm_format(uint32_t lbn);
+
 #ifdef __cplusplus
 } /* extern "C" */
 #endif