Support UUID-pinned external APFS storage for T17

[Ketchio-dev]

Outcome

Allow the T17 product E2E installer to use an explicitly selected external APFS volume. Pin the volume UUID and validate free space, paths, isolated lane state, and cleanup identity. Existing internal execution remains supported; an invalid external selection fails closed without falling back internally.

Validation

• Deterministic: scripts/check-project.sh passed after evidence reseal; another final check is running. Four XCTest shim suites: 741 passed, one skipped. Native swift test could not run because this host lacks the XCTest module; this is not counted as a pass.
• Live storage diagnostics: actual external APFS/Foundation validation, two independent disk/vars clone pairs with unchanged originals, external allocation and identity-checked cleanup passed.
• Development package: deep/strict code signing, helper signing, HVF entitlements, and third-party notice checks passed.
• Hosted CI for the pushed SHA is required and pending this PR.
• No Windows installation pilot or fixed-sample T17 campaign has passed. A9 and other open criteria remain OPEN; product state remains ENGINEERING_PREVIEW.

Risk and boundaries

External storage is opt-in and restricted to a UUID-pinned T17 directory. Disconnects, aliases, wrong volumes, and insufficient space are refused. No canonical guest disk is modified. No private media or receipts are committed. Development package composition is not a release artifact or production-signing proof. Existing machine-contract and graphics capability claims are unchanged. Rollback uses the existing internal mode or reverts the implementation; preserve failed receipts.

Checklist

• Read AGENTS.md; criteria were not weakened.
• User-approved operator-owned PLAN.md covers the change.
• Focused tests and local project check pass; hosted CI still required before merge.
• Capability wording remains generated from the registry.
• Documentation classification/link checks passed.
• No private guest data or operator-owned planning files staged.
• No test-signed inputs presented as production-signing evidence.
• Retained storage diagnostics are explicitly scoped, not installation evidence.

[Ketchio-dev]

Validation update for 1781277b1f13002e0bf87c18979f8e3d566db6a0:

• Hosted CI: https://github.com/Ketchio-dev/bridgevm/actions/runs/33978256089 — success.
• Hosted Security: https://github.com/Ketchio-dev/bridgevm/actions/runs/33978256095 — success.
• Full local scripts/check-project.sh: PASS; log SHA-256 568b42ef78fabd455421c36e27fbd1c8a43ad1a884f500fba562c3d34440d13a.
• Lane-directory denial regression failed on the old code (no receipt), then passed with all 42 deterministic T17 tier checks. This fixes failure reporting, not macOS permission grants.
• The retained earlier external pilot failed before any lane ran: Python removable-volume permission was granted, but lane mkdir was denied under a separate platform-process responsibility. Its missing-tier receipt remains unchanged; no Windows installation or criterion pass is claimed.

The PR remains draft pending the external live path. Product state and OPEN criteria are unchanged.