Recovery media: package /boot/efi and root repair tools in the initrd (issue #17)

[Copilot]

Reworked into a small, rule-compliant PR at the maintainer's request (rebase on main, don't replace scripts/build_recovery_media.sh or scripts/build_standalone_recovery_initrd.sh, keep only what's still missing for issue #17). Verified locally:

$ bash scripts/verify_recovery_tools.sh /tmp/aienos-recovery-standalone-initrd.img
...
-- required tools for /boot/efi repair --
PASS  fsck.vfat present
PASS  mkfs.vfat present
PASS  fsck.ext4 present
PASS  efibootmgr present

-- required tools for boot-entry restore --
PASS  efibootmgr present (boot entries)
PASS  chroot present
...
RECOVERY_TOOLS: PASS (initrd ships mount, EFI repair, and boot-entry restore capability)

$ bash scripts/verify_all.sh
...
--- [Recovery Media Tooling Manifest] ---
...
RECOVERY_TOOLS: PASS (initrd ships mount, EFI repair, and boot-entry restore capability)
RC=0

Full verify_all.sh run: all steps PASS, including Gate 1 QEMU zero-disk recovery, Gate 4 security suite (swTPM + 3-run soak + fault injection), and the new Recovery Media Tooling Manifest step. No FAIL anywhere. rc=0.

What issue #17 still needed

The recovery initrd from #53 already boots Machine 1 with Secure Boot on, mounts the driver stack for the NVMe/USB/keyboard, and returns to Linux unattended (Gate 1 selftest evidence). What it didn't ship yet were the tools issue #17's "done when" clause needs to actually repair /boot/efi and check the mounted root: fsck.vfat, mkfs.vfat, fsck.ext4, chroot.

What changed (10 files, +429/-8)

• scripts/build_standalone_recovery_initrd.sh: minimal, additive patch (+7/-0) to the existing BINARIES array -- adds fsck.vfat, mkfs.vfat, fsck.ext4, chroot with their shared libraries, following the script's existing copy pattern. No restructuring.
• scripts/verify_recovery_tools.sh (new): host-only, no real devices, no root. Extracts the built initrd and checks that it ships the mount / EFI-repair / boot-entry-restore tooling and init hooks. Wired into scripts/verify_all.sh (step 9) since it needs only gzip/cpio.
• scripts/collect_recovery_boot_evidence.sh (new): evidence collector for the attended recovery boot on Machine 1. Read-only -- it inspects mount state, filesystem presence, and firmware variables the kernel already exposes read-only; it never writes to the ESP, the NVMe root, or BootOrder.
• docs/RECOVERY_MEDIA_MACHINE1.md (new): operator runbook rewritten to match main's actual mechanics post-fix(recovery): package drivers and put the shell on the screen #53 -- the AIENOSRECOV stick name (not the retired ATLAS_RECOV), the real script names, and the actual shell-based repair steps (no invented rescue-menu system). States plainly that the stick must be rebuilt with the new tools and the attended boot re-run before issue Bootable recovery media for Machine 1 #17 can close.
• evidence/recovery_boot_machine1.md (new): honest PENDING ATTENDED EXERCISE template. No "merged"/"verified" language and no hardware-boot claim -- the physical repair boot has not happened.
• Small pointer edits (ROADMAP.md, docs/MILESTONES.md, docs/NATIVE_BOOT_ONE_TIME.md, docs/TRUST-1-IMPLEMENTATION-PLAN.md) linking to the new runbook and correcting stale status text.

What was dropped from the earlier draft, and why

• The ~250-line rewrite of scripts/build_standalone_recovery_initrd.sh's init/menu system (custom aienos-efi-repair helper, interactive rescue menu, LVM activation). Out of scope per the maintainer's request; main already has a working shell-based flow from fix(recovery): package drivers and put the shell on the screen #53, and the operator has full tool access from the plain shell without a bespoke menu layer.
• The edit to evidence/gate1_zero_disk_recovery_receipt.json -- an existing evidence file that must not change.
• The change to scripts/build_recovery_media.sh -- not needed for the tooling gap this PR closes.
• Deletions of unrelated files (docs/HARDWARE_TEST_RIG.md, ADRs 0010/0011, crates/aienos-kernel/src/usb/hid.rs, etc.) that were artifacts of the draft branch predating several since-merged PRs (docs(adr): formalize two-stage EL2 bootstrap to EL1h kernel transition #52-chore(agents): standing instructions and setup steps for Copilot #60). This branch is now rebased cleanly on current main (comparing main...copilot/bootable-recovery-media-machine-1 shows exactly these 10 files, ahead 5 / behind 0).

What is NOT claimed

No hardware boot happened as part of this change. The AIENOSRECOV stick as last written (#53) predates these repair tools. The operator must rebuild the stick with scripts/build_recovery_media.sh and re-run the attended boot in docs/RECOVERY_MEDIA_MACHINE1.md before issue #17 can close -- that is exactly what evidence/recovery_boot_machine1.md is a pending template for.

🤖 Generated with Claude Code

SECURITY_IMPACT: RECOVERY

[aien-dev]

@copilot heads-up: #53 (merged, 0379b2f) already builds and verifies the Machine 1 recovery media: signed shim/GRUB/kernel, 16 signed kernel modules (xHCI platform, HID, USB storage, NVMe, dm-crypt), shell on tty0, and an unattended one-shot self-test. Please rebase on main and do not replace scripts/build_recovery_media.sh or scripts/build_standalone_recovery_initrd.sh; limit this PR to anything still missing for issue #17.