feat(build): the stick and the data stick, Artemis formatted and signed at build

The stick's increment 3, Task 1 (docs/v4.0.0/plans/2026-10-27-stick-3-images.md;
STICK.md 4). make boot_image TARGET=PC now writes the 2 GiB stick: ESP 64 MiB
(BOOTX64.EFI, startup.nsh, starforth.cfg), StarshipOS identity 500 MiB (zeros),
StarshipOS Artemis to the end. make -f kernel/Makefile ARCH=<arch> datastick
writes the 1.5 GiB data stick, identity and Artemis, fresh every time. Sizes in
kernel/Makefile; every partition on whole MiB.

tools/mkartemis formats and signs an Artemis partition at build with the
kernel's own code -- v3's block_subsystem.c (blk_subsys_confirm_format) and
artemis_sig.c (artemis_sig_genesis_stamp) -- through a blkio device over a byte
range of the image; --check reads one back the same way (read-only). disk_uuid
from getrandom(2): each image its own. mkdiskimage.sh gains --starship,
--mkartemis, --esp-mib; Milk-V and the Pi images are unchanged. The kernel is
not changed.

Red: scripts/check_images.sh FAIL (no datastick, the PC image one partition).
Green: 23/23. Mutation: --check on a range shifted by one block fails.
Accepted: suite EXIT 0; 133146, 133417, 133815, POST 538/538, dict_hash
0xfec8c47cfc6f437f; test-32, 0 failures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/mkdiskimage.sh

@@ -15,6 +15,14 @@
 #                  SRC:DEST [SRC:DEST ...]
 #
 # --table gpt  -> partition type "EFI System"     (UEFI firmware, U-Boot bootefi)
+#
+# The StarshipOS stick and data stick (docs/v4.0.0/STICK.md 4; --table gpt only):
+#   --starship IDENT_MIB --mkartemis TOOL --esp-mib E
+# lays out an ESP of E MiB holding the SRC:DEST files (E=0: no ESP, no files),
+# then a StarshipOS identity partition of IDENT_MIB MiB (all zeros), then a
+# StarshipOS Artemis partition to the last whole MiB before the backup GPT,
+# formatted and signed by TOOL (tools/mkartemis.c). Every partition starts and
+# ends on a whole MiB, so on 1 KiB blocks, as the kernel's GPT reader needs.
 # --table mbr  -> partition type 0x0c FAT32 (LBA)  (Raspberry Pi firmware)
 # DEST is an absolute path inside the FAT filesystem; parent directories are
 # created as needed.
@@ -23,13 +31,16 @@
 # root, no loop devices.
 set -euo pipefail
 
-OUT="" TABLE="" SIZE_MIB="" LABEL=""
+OUT="" TABLE="" SIZE_MIB="" LABEL="" IDENT_MIB="" MKARTEMIS="" ESP_MIB=""
 while [ $# -gt 0 ]; do
     case "$1" in
         --out)      OUT="$2"; shift 2 ;;
         --table)    TABLE="$2"; shift 2 ;;
         --size-mib) SIZE_MIB="$2"; shift 2 ;;
         --label)    LABEL="$2"; shift 2 ;;
+        --starship) IDENT_MIB="$2"; shift 2 ;;
+        --mkartemis) MKARTEMIS="$2"; shift 2 ;;
+        --esp-mib)  ESP_MIB="$2"; shift 2 ;;
         --) shift; break ;;
         -*) echo "mkdiskimage.sh: unknown option $1" >&2; exit 2 ;;
         *) break ;;
@@ -38,7 +49,12 @@ done
 
 [ -n "$OUT" ] && [ -n "$TABLE" ] && [ -n "$SIZE_MIB" ] && [ -n "$LABEL" ] || {
     echo "mkdiskimage.sh: --out, --table, --size-mib and --label are required" >&2; exit 2; }
-[ $# -gt 0 ] || { echo "mkdiskimage.sh: no SRC:DEST files given" >&2; exit 2; }
+if [ -n "$IDENT_MIB" ]; then
+    [ "$TABLE" = gpt ] && [ -n "$MKARTEMIS" ] && [ -n "$ESP_MIB" ] || {
+        echo "mkdiskimage.sh: --starship needs --table gpt, --mkartemis and --esp-mib" >&2; exit 2; }
+    [ "$ESP_MIB" -gt 0 ] || [ $# -eq 0 ] || { echo "mkdiskimage.sh: --esp-mib 0 takes no files" >&2; exit 2; }
+fi
+[ $# -gt 0 ] || [ "${ESP_MIB:-}" = 0 ] || { echo "mkdiskimage.sh: no SRC:DEST files given" >&2; exit 2; }
 
 for tool in sfdisk mkfs.fat mmd mcopy; do
     command -v "$tool" >/dev/null 2>&1 || PATH="$PATH:/usr/sbin:/sbin"
@@ -54,13 +70,37 @@ case "$TABLE" in
     *) echo "mkdiskimage.sh: --table must be gpt or mbr" >&2; exit 2 ;;
 esac
 PART_SECTORS=$(( LAST - START + 1 ))
+# StarshipOS partition types (kernel/src/gpt.c)
+IDENT_TYPE="23BEBFE1-4817-4CF3-A537-9069BF159788"
+ART_TYPE="BCD7B586-1C8E-4EEF-86A3-273A8D8EE624"
+if [ -n "$IDENT_MIB" ]; then
+    PART_SECTORS=$(( ESP_MIB * 2048 ))
+    IDENT_START=$(( START + PART_SECTORS ))
+    IDENT_SECTORS=$(( IDENT_MIB * 2048 ))
+    ART_START=$(( IDENT_START + IDENT_SECTORS ))
+    ART_SECTORS=$(( (LAST + 1 - ART_START) / 2048 * 2048 ))
+    [ "$ART_SECTORS" -gt 0 ] || { echo "mkdiskimage.sh: no room for Artemis in ${SIZE_MIB} MiB" >&2; exit 2; }
+fi
 
 ESP="$OUT.part1"
 rm -f "$OUT" "$ESP"
 mkdir -p "$(dirname "$OUT")"
 
 truncate -s $(( TOTAL_SECTORS * 512 )) "$OUT"
-if [ "$TABLE" = gpt ]; then
+if [ -n "$IDENT_MIB" ]; then
+    {
+        echo "label: gpt"
+        [ "$ESP_MIB" -gt 0 ] && printf 'start=%d, size=%d, type=%s, name="EFI System"\n' "$START" "$PART_SECTORS" "$PTYPE"
+        printf 'start=%d, size=%d, type=%s, name="StarshipOS identity"\n' "$IDENT_START" "$IDENT_SECTORS" "$IDENT_TYPE"
+        printf 'start=%d, size=%d, type=%s, name="StarshipOS Artemis"\n' "$ART_START" "$ART_SECTORS" "$ART_TYPE"
+    } | sfdisk --quiet "$OUT"
+    "$MKARTEMIS" --format "$OUT" --first-lba "$ART_START" --sectors "$ART_SECTORS" >/dev/null || {
+        echo "mkdiskimage.sh: formatting Artemis failed" >&2; rm -f "$OUT"; exit 1; }
+    if [ "$ESP_MIB" = 0 ]; then
+        echo "  IMAGE   $OUT (gpt, ${SIZE_MIB} MiB: StarshipOS identity ${IDENT_MIB} MiB, Artemis $(( ART_SECTORS / 2048 )) MiB)"
+        exit 0
+    fi
+elif [ "$TABLE" = gpt ]; then
     printf 'label: gpt\nstart=%d, size=%d, type=%s, name="EFI System"\n' \
         "$START" "$PART_SECTORS" "$PTYPE" | sfdisk --quiet "$OUT"
 else
@@ -88,4 +128,8 @@ done
 
 dd if="$ESP" of="$OUT" bs=512 seek="$START" conv=notrunc status=none
 rm -f "$ESP"
-echo "  IMAGE   $OUT ($TABLE, ${SIZE_MIB} MiB, FAT32 '$LABEL')"
+if [ -n "$IDENT_MIB" ]; then
+    echo "  IMAGE   $OUT (gpt, ${SIZE_MIB} MiB: ESP ${ESP_MIB} MiB FAT32 '$LABEL', StarshipOS identity ${IDENT_MIB} MiB, Artemis $(( ART_SECTORS / 2048 )) MiB)"
+else
+    echo "  IMAGE   $OUT ($TABLE, ${SIZE_MIB} MiB, FAT32 '$LABEL')"
+fi