Prepare Sargo installations with private per-device workspaces

Bind backups, storage layout, RAM builds, file staging and recovery to each phone. Verify atomic transfers without replacing existing state and record the unresolved Android HAL source provenance.

Validated with 53 native tooling tests, 5 changelog tests and two RAM boots with persistent Gaia state on the development Sargo. No new flash or native binary release.

tundra/tools/export-sargo-recovery.py

@@ -54,9 +54,14 @@ def export(plan, output):
 def main():
     parser = argparse.ArgumentParser(description=__doc__)
     parser.add_argument('--output', type=Path, required=True)
+    parser.add_argument('--device-workspace', type=Path)
     args = parser.parse_args()
     os.umask(0o077)
-    plan = load('backup_plan', ROOT/'tools/test-sargo-boot.py').checked_backup_plan()
+    if args.device_workspace:
+        from sargo_workspace import checked_workspace
+        plan, _ = checked_workspace(args.device_workspace)
+    else:
+        plan = load('backup_plan', ROOT/'tools/test-sargo-boot.py').checked_backup_plan()
     print(export(plan, args.output))
     print('Keep this private kit on another disk. Its boot image belongs only to this phone.')