Fix silent disk overwrite of unrecognized Artemis disks

The generic block subsystem (blk_format_or_load_disk) auto-reformatted
any disk lacking its own low-level 'STFR' header at attach time, before
Artemis's Forth-level BLANK/LithosAnanke/Unrecognized classification
ever ran -- so ART-HALT-UNRECOG's "Disk preserved" message was false.

Split detection from commit: an unrecognized/blank disk is now left
PROVISIONAL (geometry computed in memory only, all writes refused)
until explicitly confirmed via the new blk_subsys_confirm_format() /
BLK-CONFIRM-FORMAT primitive. Artemis calls it from ART-FORMAT and
ART-RESUME, never from ART-HALT-UNRECOG.

Verified on amd64/aarch64/riscv64: parity intact (identical dict_hash),
normal recognized-disk resume + persist-read unaffected, and a
regenerated disk/artemis-unrecognized-test.img (the old copy had itself
been silently corrupted by this exact bug) now stays byte-for-byte
identical across a halted boot on amd64 and riscv64.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.claude/ARTEMIS.md

@@ -156,9 +156,23 @@ Acceptance criteria status, verified 2026-08-02:
    silently stuck failing this exact test since before this repo's git
    history begins (bad *data* from some pre-history run, not bad code)
    until reformatted this same day — see `disk/README.md`.
-6. ⬜ `ART-HALT-UNRECOG` exists and looks correct by inspection, but has
-   not actually been exercised against genuinely unrecognized disk
-   content — untested, not confirmed.
+6. ✅ `ART-HALT-UNRECOG` exercised against genuinely unrecognized disk
+   content and confirmed to leave the disk byte-for-byte untouched
+   (sha256 identical before/after), on amd64 and riscv64 — see
+   `disk/README.md`. This closes a real gap found and fixed 2026-08-02:
+   the *generic* block subsystem (`src/block_subsystem.c`) used to
+   auto-reformat any disk it didn't recognize by its own low-level
+   header magic, at attach time, before Artemis's Forth-level
+   BLANK/LithosAnanke/Unrecognized check ever ran — so a halted boot's
+   "Disk preserved" message was previously false. Fixed by splitting
+   the block subsystem's disk detection from disk commit: an
+   unrecognized/blank disk is now left `PROVISIONAL` (geometry computed
+   in memory only, all writes refused) until the disk's owner explicitly
+   calls the new `BLK-CONFIRM-FORMAT ( lbn -- )` primitive. Artemis calls
+   it from `ART-FORMAT` and `ART-RESUME` (`capsules/artemis/init.4th`
+   block 4126) — never from `ART-HALT-UNRECOG`. See
+   `src/block_subsystem.c`'s `blk_format_or_load_disk` /
+   `blk_commit_format` / `blk_subsys_confirm_format` for the mechanism.
 
 Not done: everything under "FUTURE MATERIAL" below (zones, USB hot-plug,
 ACL records, PKI) — that line remains accurate and unchanged.