block: per-sender range confinement — V2a mechanism

The block protocol gains define_range (appended, numbers hold): confine the
process named by `badge` to blocks [base, base+count). usb-storage keeps a
per-badge range table and, in read/write, translates volume-relative LBAs
(base added) and refuses any transfer past the volume end. geometry returns
the confined size, so a filesystem mounts against what it may actually touch.

The security seam (decision 4, settled): the clamp lives at the PROVIDER, so
a channel carries exactly the authority it grants — handing a filesystem the
whole disk plus a base offset would let it reach the neighbouring partition.
The gate: a confined caller may NOT call define_range, so a filesystem cannot
widen its own range or confine anyone; only an unconfined party (the volume
manager, whole-device) may. The volume manager defines a filesystem's range
before handing it the channel, so the ordering holds by construction.

Default (no range for a badge) is the whole device — behaviour-neutral for a
single-volume boot and what the volume manager itself uses to probe
partitions. The range table is declared through bounds.md as a runaway
detector (ours, refuse at limit), not a real-partition cap. Neutral:
fat-mount, usb-storage, iommu-usb-storage green. The discrimination fixture
(a confined process reads past its range and is refused) follows next.

library/device/block/block.zig

@@ -63,6 +63,15 @@ pub const Device = struct {
         return self.call(.flush, {}, null, &reply) != null;
     }
 
+    /// Confine the process `badge` to blocks `[base_lba, base_lba + block_count)`
+    /// on this device — the volume manager's per-volume grant to a filesystem.
+    /// The caller must itself be unconfined (whole-device); a confined caller is
+    /// refused, so a filesystem cannot widen its own range. See `DefineRange`.
+    pub fn defineRange(self: Device, badge: u32, base_lba: u64, block_count: u64) bool {
+        var reply: [block_protocol.message_maximum]u8 = undefined;
+        return self.call(.define_range, .{ .badge = badge, .base_lba = base_lba, .block_count = block_count }, null, &reply) != null;
+    }
+
     /// One request at the driver. `target` is always 0: one endpoint per device, so
     /// there is no object within the peer to address.
     fn call(