Prepare Sargo installations with private per-device workspaces

Bind backups, storage layout, RAM builds, file staging and recovery to each phone. Verify atomic transfers without replacing existing state and record the unresolved Android HAL source provenance.

Validated with 53 native tooling tests, 5 changelog tests and two RAM boots with persistent Gaia state on the development Sargo. No new flash or native binary release.

tundra/tests/test_build_sources.py

@@ -1,9 +1,11 @@
 # SPDX-License-Identifier: MPL-2.0
 import importlib.util
+import json
 from pathlib import Path
 import sys
 import tempfile
 import unittest
+from unittest.mock import patch
 
 ROOT=Path(__file__).resolve().parents[1]
 sys.path.insert(0,str(ROOT/'tools'))
@@ -32,5 +34,13 @@ class SourceSnapshotTests(unittest.TestCase):
         self.build['sources']={'../../outside':'hash'}
         with self.assertRaises(ValueError):rescue.verify_sources(self.folder,self.build)
 
+    def test_workspace_required_before_any_device_command(self):
+        (self.folder/'build.json').write_text(json.dumps({'image':'boot.img','deviceWorkspaceSha256':'a'*64}))
+        with patch.object(sys,'argv',['test-rescue-boot','--build',str(self.folder),'--boot']), \
+             patch.object(rescue.subprocess,'run') as run:
+            with self.assertRaisesRegex(ValueError,'requires --device-workspace'):
+                rescue.main()
+            run.assert_not_called()
+
 
 if __name__=='__main__':unittest.main()