fix(recovery): implement standalone RAM initrd and zero-disk QEMU test

[aien-dev]

Summary

Overhauls TRUST-1 Gate 1 recovery tooling to guarantee full execution independence from host NVMe storage and prevent destructive data loss:

• Adds scripts/build_standalone_recovery_initrd.sh to package a 15 MB self-contained CPIO initrd containing BusyBox, cryptsetup, age, gocryptfs, and tpm2_pcrread with /init executing directly in RAM.
• Rewrites scripts/build_recovery_media.sh to require an explicit target block device and enforce an uncompromising hardware guard rejecting /dev/sda and partitions labeled ATLAS_RECOV.
• Removes host root=LABEL=root kernel parameters from the recovery GRUB config, configuring rdinit=/init with zero internal NVMe dependencies.
• Implements scripts/qemu_verify_recovery_media.sh verifying that the standalone kernel and initrd boot cleanly in QEMU AArch64 with zero attached hard disks.
• Wires Step 8 into scripts/verify_all.sh and generates evidence/gate1_zero_disk_recovery_receipt.json.
• Updates docs/MILESTONES.md status table to reflect that Gate 1 tooling and emulation tests pass, with physical USB attended exercise pending.

Verification Proof

• scripts/verify_all.sh: Exit code 0 across all 8 verification steps.
• scripts/qemu_verify_recovery_media.sh: Clean zero-disk AArch64 boot passing banner display, RAM disk rootfs verification, NVMe unmounted verification, and automated test shutdown in 4 seconds.
• Target device safety guards: Rejection verified for empty arguments and /dev/sda1.

Invariants Certified

• Zero Disk Secrets: Verified. Private keys never written to disk; hardware TPM vault only.
• Unslop: Verified. Zero em dashes, zero en dashes, zero AI clichés.