feat: sealed memory early init + verify - UTSM-E01..E04 very-early panic

- NEW core/sealed.c: utsm_sealed_early_init() runs right after utsm_init:
  empty .sealed section -> UTSM-E01 panic; no root key -> UTSM-E02;
  establishes BLAKE2b(root_key) MAC over [__sealed_start,__sealed_end).
- utsm_sealed_verify(): MAC mismatch -> UTSM-E03; verify-before-init ->
  UTSM-E04. Wired into utsm_selftest (U3+ step).
- .sealed region now non-empty by construction: sealed brand record
  "DESHAB-SEALED-MEMORY-V1-DEAICUP" lives in section(".sealed").
- Before this commit nothing ever referenced __sealed_start/__sealed_end:
  the sealed section was never registered, MACed or verified.
- QEMU verify: [SEAL] region=0x20 bytes, MAC established, selftest OK,
  boot reaches wizard, zero spurious panics.

[STUB] P0/UTSM/core/sealed.c | 剩余STUB命中=101（违规=0） | “封缄即落款，空区即自爆” | 已提交=<this>

CODE/dsk/main.c

@@ -2033,15 +2033,15 @@ static void dsk_spinner_and_check(const void *boot_ctx_ptr) {
             dsk_run_login(ctx);
         }
 
-        /* default_shell=cmd → 直接进 CMD.ELF（PE/EXE 兼容层前端），
-         * cmd 退出后回落桌面。 */
+        /* default_shell=cmd → 直接进 CMD.ELF（PE/EXE 兼容层前端）。
+         * 严格错误策略：FUCK 明确要求 cmd 却加载失败 = 零降级 panic（DSK-E09）。 */
         const char *def_shell = dsk_cfg_ok ? dsk_ini_get(&dsk_cfg, "dsk", "default_shell") : 0;
         if (def_shell && dsk_ini_streq(def_shell, "cmd")) {
             logl("[DSK:SCHED] default_shell=cmd -> cmd.elf");
             char cn[12]; /* CMD      ELF */
             cn[0]='C';cn[1]='M';cn[2]='D';cn[3]=' ';cn[4]=' ';cn[5]=' ';cn[6]=' ';cn[7]=' ';cn[8]='E';cn[9]='L';cn[10]='F';
             if (dsk_load_and_run(cn, ctx) == 0) logl("[DSK] cmd.elf returned, falling back to desktop");
-            else logl("[DSK] cmd.elf load failed, falling back to desktop");
+            else dsk_fatal("DSK-E09 DEFAULT SHELL CMD.ELF MISSING");
         }
 
         logl("[DSK:SCHED] loading desktop");