Fix silent disk overwrite of unrecognized Artemis disks

The generic block subsystem (blk_format_or_load_disk) auto-reformatted
any disk lacking its own low-level 'STFR' header at attach time, before
Artemis's Forth-level BLANK/LithosAnanke/Unrecognized classification
ever ran -- so ART-HALT-UNRECOG's "Disk preserved" message was false.

Split detection from commit: an unrecognized/blank disk is now left
PROVISIONAL (geometry computed in memory only, all writes refused)
until explicitly confirmed via the new blk_subsys_confirm_format() /
BLK-CONFIRM-FORMAT primitive. Artemis calls it from ART-FORMAT and
ART-RESUME, never from ART-HALT-UNRECOG.

Verified on amd64/aarch64/riscv64: parity intact (identical dict_hash),
normal recognized-disk resume + persist-read unaffected, and a
regenerated disk/artemis-unrecognized-test.img (the old copy had itself
been silently corrupted by this exact bug) now stays byte-for-byte
identical across a halted boot on amd64 and riscv64.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

capsules/artemis/init.4th

@@ -142,11 +142,15 @@ Block 4125
   DROP UPDATE ;
 Block 4126
 ( Boot sequence -- format/resume/halt words )
+( BLK-CONFIRM-FORMAT commits the disk container -- only on )
+( paths that don't halt, so unrecognized disks stay untouched )
 : ART-FORMAT ( -- )
   ." Artemis: blank disk -- formatting" CR
+  ART-HDR-LBN BLK-CONFIRM-FORMAT
   ART-HDR-WRITE FLUSH ;
 : ART-RESUME ( -- )
-  ." Artemis: LithosAnanke disk -- resuming" CR ;
+  ." Artemis: LithosAnanke disk -- resuming" CR
+  ART-HDR-LBN BLK-CONFIRM-FORMAT ;
 : ART-HALT-UNRECOG ( -- )
   ." ARTEMIS HALT: unrecognized disk content" CR
   ." Disk preserved. Manual intervention required." CR