test: block-range — the discrimination fixture for range confinement (V2a)

A process acquires a block channel the way a filesystem does (consumer-hello
the device manager), confines ITSELF to blocks [1,3), then proves the clamp
and the gate: volume-relative LBA 0 maps inside the range and reads; a read
reaching past the range is refused; geometry reports the confined size; and
a confined caller can no longer call define_range (no widening, no escape).
It gates on argv so the ramdisk sweep leaves it silent in other boots, and
coexists with fat (ranges are per-badge).

Discrimination (verified by reverting usb-storage to pre-clamp f1bdce2~1):
the unconfined read still succeeds but define_range returns ENOSYS, so the
fixture cannot arm confinement and the case fails — exactly the property
the clamp adds. With the clamp: block-range 1/1.

build.zig

@@ -343,6 +343,7 @@ pub fn build(b: *std.Build) void {
         "protocol-denied-test", // restriction stage one: an ungranted open answers as absence
         "protocol-conformance-test", // the reserved verbs, asked of every provider the boot bound
         "device-authority-test", // the attacker: a process handed no device, asserting what it cannot do
+        "block-range-test", // confines itself to a block sub-range, then proves it cannot cross or widen it
     }) |fixture| {
         const package = b.lazyDependency(fixture, .{}) orelse
             @panic("a test fixture package is missing under test/system/services");