Recovery password is falsely reported persistent when state is unavailable

[Deadbytes101]

Physical alpha.10 reboot exposed that rigos-recovery-access writes the rigosadmin password hash under /var/lib/rigos/recovery even when persistent state was never mounted. In that case the path is only the live overlay, credential_persisted is reported true, and the password disappears on reboot, forcing setup again.

Observed alongside issue #24 (resize2fs timed out and state remained unavailable).

Required behavior:

• never claim persistence unless /var/lib/rigos is the current verified persistent state mount
• never write a credential hash into an unverified or overlay-backed /var/lib/rigos
• when state is unavailable, explicitly mark the credential as boot-scoped while keeping local/SSH diagnostics available
• once state initialization succeeds, persist the password hash exactly once and restore it on subsequent boots without prompting
• retain strict hash validation, atomic writes, redaction, and fail-closed configuration/miner behavior
• add source and image regression coverage

The underlying state timeout is tracked separately in #24.

[Deadbytes101]

Fix implemented in draft PR #26 at exact head 6a11d1c3d4e978e7959a0e2950c05cf1f440194b.

rigos-recovery-access now persists the password hash only when state status belongs to the current boot, reports ready, names /var/lib/rigos, and findmnt proves an exact rw ext4 mount with the required safety options. When state is unavailable it does not create or write /var/lib/rigos/recovery; status is explicitly credential_scope=boot and credential_persisted=false.

The recovery validator accepts either truthful persistent scope with ready state or truthful boot scope with unavailable state, allowing diagnostic SSH without a false persistence claim.

Source gate, exact image, and physical reboot restore remain pending.

[Deadbytes101]

Alpha.11 source regression evidence passed at exact head 5d9e5b2e91783a57a51d6802d7d269f9428e92e7.

Recovery access tests passed for both verified persistent credentials and explicit boot-scoped credentials. False persistence claims are rejected, stale status is rejected, and the full WSL source gate ended with RIGOS_WSL_SOURCE_GATE=PASS.

Physical password restoration across reboot remains pending on an exact Alpha.11 image.