[otavio]

Follow-up to #460, and stacked on it: the first eight commits are #460's, only the last three are new. Please review those three, and merge after #460.

Problem

#460 lets a raw object write a whole disk beside its mounted partitions, as long as the write misses them. The partition tables lie outside every partition, so this also allowed overwriting them. On a loop disk with ext4 mounted from p1, zeroing MBR sector 0, or GPT LBA 0–33 and the last 33 sectors, was refused on master but allowed by #460. The mount kept working, but sfdisk -d found no table and, after blockdev --rereadpt (what the next boot sees), p1 was gone.

Fix

A write reaching the partition table of a disk with partitions is refused while anything on that disk is mounted, with a new PartitionTableInUse error. With nothing mounted, an image carrying the table still installs. A write reaching a mounted partition still fails with DeviceInUse, as before.

Only the bytes that keep partitions in place are protected:

• MBR: bytes 440 to 512 (disk signature, entries, 0x55AA). BIOS loaders such as GRUB's boot.img or syslinux mbr.bin keep writing the boot code ahead of them.
• EBR: every sector in the chain of an extended partition. The walk stays inside the container and is bounded, so a corrupt chain cannot loop.
• GPT: both headers and the whole entry arrays they declare, located from the headers in logical blocks (queue/logical_block_size). Allwinner GPT layouts that shrink or move the entries out of the SPL's way at 8 KiB keep working. As the kernel does, a GPT is only looked for behind a protective or hybrid MBR, so a stale GPT header on an MBR disk does not block i.MX6 U-Boot at 1 KiB. The backup is looked for where the primary says, or on the last sector when the primary is unusable.

A table that cannot be read or makes no sense holds no partition in place, so it is left out with a warning. Disks partitioned from the kernel command line (blkdevparts=) keep #460's behaviour.

The disk is read through the target path, read-only, with no new dependencies.

Writes that leave the table bytes unchanged are refused like any other overlap, as on master.

Tests

• Unit tests without root for the parser, on in-memory images: MBR, three logical partitions, looping and out-of-bounds EBR links, GPT with 512 and 4096-byte sectors, shrunk and relocated entries, stale GPT, missing backup, nonsense header.
• Root tests on loop disks, which CI now runs:
  • Table bytes are refused beside a mount and allowed once unmounted: MBR, EBRs, GPT, GPT with 4 KiB sectors.
  • These layouts stay allowed: i.MX6 at 1 KiB (MBR), i.MX8M and Rockchip at 32 KiB, am335x from 128 KiB, Allwinner SPL at 8 KiB beside a shrunk or relocated GPT.
  • Through the raw installer, the original reproduction is refused, and a 440-byte boot code installs beside a mount, leaving the table intact.
• FakeLoopDevice::with_image attaches any image, setting 4 KiB logical blocks through LOOP_SET_BLOCK_SIZE, since loopdev cannot.

cargo fmt --check, cargo clippy --all-features --all --tests -- -D clippy::all, the workspace tests and the root tests all pass locally, with no loop devices or mounts left behind.