refactor(kernel): Zuse's drive check without a VM

capsule_zuse_boot_check() makes the check capsule_zuse_boot_try_attach()
made -- the genesis marker, the drive's identity record (magic, version,
CRC-64, public key) -- and says HERS, GENESIS or NOT_HERS, with no VM;
capsule_zuse_boot_root_pubkey() reads the marker's key. try_attach and
load_root_pubkey call them; their behaviour and messages are unchanged.
The v4 boot will make the same check (identity gate plan, D1).

Shown on v3 (system=v3, amd64): the minted pair, "Zuse: identity
confirmed" and [zuse@Hera] ok> (logs/20261026-083603); a blank pair,
"Zuse: genesis minted onto attached thumbdrive" (logs/20261026-084729).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

kernel/include/starkernel/capsule_zuse_boot.h

@@ -27,6 +27,36 @@
 
 struct blkio_dev;
 
+/** What a just-attached drive is to Zuse (capsule_zuse_boot_check()). */
+typedef enum {
+    ZUSE_DRIVE_NOT_HERS = 0, /* another identity's, foreign, corrupt, or no genesis and not blank */
+    ZUSE_DRIVE_HERS,         /* the genesis marker's drive: its identity record checks out */
+    ZUSE_DRIVE_GENESIS       /* no genesis marker yet, and the drive is blank: eligible */
+} zuse_drive_t;
+
+/**
+ * capsule_zuse_boot_check - The check capsule_zuse_boot_try_attach() makes,
+ * with no VM: the v3 path and the v4 boot both use it
+ * (docs/v4.0.0/plans/2026-10-26-engine-step4-identity-gate.md, D1).
+ * Reads the genesis marker from the block subsystem's metadata fence and,
+ * when there is one, the drive's own identity record (magic, version,
+ * CRC-64, public key against the marker's). Writes nothing.
+ *
+ * @param seed, pubkey Zuse's seed and public key, filled in only for
+ *                     ZUSE_DRIVE_HERS.
+ */
+zuse_drive_t capsule_zuse_boot_check(struct blkio_dev *dev,
+                                      homeblocks_sig_result_t sig_rc,
+                                      const homeblocks_sig_t *sig,
+                                      uint8_t seed[32], uint8_t pubkey[32]);
+
+/**
+ * capsule_zuse_boot_root_pubkey - Zuse's public key from the genesis
+ * marker. Returns 0 with @p pubkey filled in, or -1 (no genesis yet, or the
+ * marker fails its checks; @p pubkey untouched).
+ */
+int capsule_zuse_boot_root_pubkey(uint8_t pubkey[32]);
+
 /**
  * capsule_zuse_boot_try_attach - Try to genesis-mint or authenticate
  * Zuse from a just-attached drive.