test: block-range — the discrimination fixture for range confinement (V2a)

A process acquires a block channel the way a filesystem does (consumer-hello
the device manager), confines ITSELF to blocks [1,3), then proves the clamp
and the gate: volume-relative LBA 0 maps inside the range and reads; a read
reaching past the range is refused; geometry reports the confined size; and
a confined caller can no longer call define_range (no widening, no escape).
It gates on argv so the ramdisk sweep leaves it silent in other boots, and
coexists with fat (ranges are per-badge).

Discrimination (verified by reverting usb-storage to pre-clamp f1bdce2~1):
the unconfined read still succeeds but define_range returns ENOSYS, so the
fixture cannot arm confinement and the case fails — exactly the property
the clamp adds. With the clamp: block-range 1/1.

test/system/services/block-range-test/build.zig

@@ -0,0 +1,19 @@
+//! The block-range-test fixture as a binary package (docs/build-packages-plan.md):
+//! this file names the binary and EXACTLY the modules its source imports —
+//! build-support resolves each name from the domains this zon declares.
+
+const std = @import("std");
+const build_support = @import("build-support");
+
+pub fn build(b: *std.Build) void {
+    const exe = build_support.userBinary(b, .{
+        .name = "block-range-test",
+        .root_source_file = b.path("block-range-test.zig"),
+        .imports = &.{
+            "block",   "channel", "device-manager-protocol", "driver",
+            "envelope", "ipc",    "logging",                 "memory",
+            "process", "time",
+        },
+    });
+    b.installArtifact(exe);
+}