Wire homeblocks_sig_check() into USB attach: the warn half (Phase 8)

Wired into sk_repl_idle()'s USB hotplug attach handler, right between
blkio_usb_open_msc() succeeding and blk_subsys_attach_device() -- logs
a distinct message per outcome (recognized / blank-or-foreign /
bad-version / bad-crc / read-error).

The "refuse" half is deliberately not implemented -- there is nothing
real to gate yet. blkio_usb.c has no SCSI WRITE(10) support at all, so
there is no write path today to refuse; attach currently only enables
read-only access, which is also the general-purpose USB block I/O
path this repo already relies on for unrelated testing, not
exclusively a home-blocks identity workflow. Refusing attach on blank
media would break that legitimate use without protecting anything
real -- same "don't build ahead of a real caller" reasoning EXPIRE's
deferral used. Refuse belongs on the write path once WRITE(10) exists.

sig_start_fblock is hardcoded to 0 at the call site -- correct for
today's unpartitioned raw test/real media (no GPT parser exists yet),
flagged in the comment as the one place that changes once a real
GPT-partition-relative lookup exists, isolated from
homeblocks_sig.c's own location-agnostic check logic.

Verified live: hot-attached disk/usb-thumbdrive-test.img (blank media)
through a running amd64 instance's QMP socket (blockdev-add +
device_add usb-storage) -- captured exactly 4 real TUR+READ10 BOT
cycles (matching the header's 4 forth-block span) followed by the
correct "not recognized" warning, then normal attach completing
successfully afterward (no regression). Conservation intact, no
panic. Clean zero-warning compile and clean boot on all three
architectures.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn

FABRIC-3.md

@@ -235,9 +235,35 @@ decisions get added here, not to `FABRIC-2.md`. Follow the same discipline `FABR
   build/link regression from exposing `compute_crc64` and adding the new source file to
   every kernel build.
 
-- [ ] Implement the warn-and-refuse behavior for blank/foreign/unrecognized media — this is
-  where `homeblocks_sig_check()` above actually gets a live caller, wiring it into the real
-  drive-insertion path.
+- [x] **Implemented (2026-08-26): the "warn" half, live and wired.** Wired into
+  `sk_repl_idle()`'s USB hotplug attach handler (`repl.c`), right between
+  `blkio_usb_open_msc()` succeeding and `blk_subsys_attach_device()` — calls
+  `homeblocks_sig_check(&usb_blk_dev, 0, &sig)` and logs a distinct message per outcome
+  (recognized / blank-or-foreign / bad-version / bad-crc / read-error).
+
+  **The "refuse" half is deliberately not implemented — there is nothing real to gate yet.**
+  `blkio_usb.c` has no SCSI `WRITE(10)` support at all (Milestone 2's biggest open item), so
+  there is no write path today to refuse; the only thing attach currently enables is
+  read-only access, which is also the general-purpose USB block I/O path this repo already
+  relies on for unrelated testing, not exclusively a home-blocks identity workflow. Refusing
+  attach on blank media would have broken that legitimate use without protecting anything
+  real — building that gate now would be enforcement with no live consumer, the same
+  "don't build ahead of a real caller" reasoning `EXPIRE`'s deferral used. Refuse belongs on
+  the write path once `WRITE(10)` exists to give it something to gate against.
+
+  `sig_start_fblock` is hardcoded to `0` at the call site — correct for today's unpartitioned
+  raw test/real media (no GPT parser exists yet), explicitly flagged in the code comment as
+  the one place that will need to change to a real GPT-partition-relative lookup once that
+  parser lands, isolated from `homeblocks_sig.c`'s own location-agnostic check logic.
+
+  **Verified live**, not just compiled: hot-attached `disk/usb-thumbdrive-test.img` (blank
+  media, no `LAHB` magic) through a running amd64 instance's QMP socket (`blockdev-add` +
+  `device_add usb-storage,bus=xhci0.0`) — captured exactly 4 real TUR+READ10 BOT cycles
+  (matching the header's 4 forth-block span) followed by `xhci: USB drive not recognized
+  (blank or foreign media) -- read-only general use only`, then normal attach completing
+  successfully afterward (no regression — no `MSC block-subsystem attach failed`).
+  Conservation intact, no panic. Clean zero-warning compile and clean boot on all three
+  architectures.
 
 - [ ] Extend `acl_pinned`'s one-way-ratchet mechanism (already exists, already proven, just
   needs applying) to gate zuse credential minting specifically — confirm whether this