[botandbang]

What and why

The scheduled workflow gets a disk-images job on macOS, Linux and Windows. Each test creates a small disk image, attaches it, runs format::apply or eject against it, and detaches it. The images are hdiutil images on macOS, loop devices on Linux (run as root through sudo as nextest's target runner) and VHDs on Windows. The tests return at once unless LOCALLIBRARY_DISK_IMAGE_TESTS=1, so ordinary cargo test and PR CI never touch a device.

Added: format/disk_image.rs, a test-only guard that attaches an image and detaches it on drop (also when a test panics). It finds the device by the image's file, so it can't detach anything else, and it checks before every destructive call that the disk is the one it attached. The format test checks that an image is refused, then formats FAT32 on MBR and exFAT, checks a stale plan is refused, and checks that a drive keeps its name across a format where the system mounts the volume. The macOS eject test uses a two-partition image: eject is refused while the store is on the other partition, the plan names the other volume, and applying it detaches the image. There are also unit tests for the seam.

Changed: the format code refuses every disk image, loop device and virtual disk. A test build lets through only the one image its test attached, matched by exact identifier on that thread. On Linux this is also the only loop device parsed as a disk.

Removed: LOCALLIBRARY_FORMAT_VIRTUAL, which let format take any disk image and which nothing used.

The Linux and Windows legs, and the macOS format and eject tests, have not run yet. The first weekly or manual run of locallibrary scheduled is their first test.

Refs LOC-67 (the Linux and Windows legs and the macOS format and eject tests are unverified until the scheduled job runs)
Refs #168

How it was tested

• cargo fmt --check -p locallibrary, and cargo clippy -p locallibrary --all-targets -- -D warnings on macOS (so the Linux and Windows modules of disk_image.rs were not compiled).
• cargo nextest run -p locallibrary on the format and eject tests: 152 pass.
• With LOCALLIBRARY_DISK_IMAGE_TESTS=1, an_image_is_detached_when_its_test_ends passes with a real hdiutil attach and detach. Skipping detach while panicking made it fail with "still attached".
• The two seam unit tests fail when the seam is loosened (the virtual_disk && guard dropped, the Linux loop check forced true).
• actionlint and zizmor --offline on the scheduled workflow, and tools/policy.sh.
• Not run: the macOS format and eject tests (partitioning an image needs approval to run here), the Linux and Windows legs, and Windows clippy.

Checklist

• Tests cover the change
• For locallibrary: apps/locallibrary/CHANGELOG.md has a line under Unreleased, if people using it will notice
• The READMEs, docs/ and --help still say what the code does

[linear-code]

LOC-67

[github-actions]

Rust coverage

From run 35. Both are held to the thresholds in .cargo/config.toml.

Tests	Lines	Functions	Regions
All	97.38% (84403/86671)	96.51% (13503/13991)	95.66% (185837/194268)
Hegel property tests alone	95.38% (82665/86671)	94.09% (13164/13991)	93.45% (181553/194268)

[botandbang]

Closing and reopening so CI runs against current main (with #353's CodeQL fix). Branch unchanged.