release v0.9.1: VM verification sweep 22 → 27

Five more CVEs empirically confirmed end-to-end against real Linux VMs:
- CVE-2019-14287 sudo_runas_neg1 (Ubuntu 18.04 + sudoers grant)
- CVE-2020-29661 tioscpgrp        (Ubuntu 20.04 pinned to 5.4.0-26)
- CVE-2024-26581 nft_pipapo       (Ubuntu 22.04 + mainline 5.15.5)
- CVE-2025-32463 sudo_chwoot      (Ubuntu 22.04 + sudo 1.9.16p1 from source)
- CVE-2025-6019  udisks_libblockdev (Debian 12 + udisks2 + polkit rule)

Required real plumbing work:
- Per-module provisioner hook (tools/verify-vm/provisioners/<module>.sh)
- Two-phase provision in verify.sh (prep → reboot if needed → verify)
  fixes silent-fail where new kernel installed but VM never rebooted
- GRUB_DEFAULT pinning in both pin-kernel and pin-mainline blocks
  (kernel downgrades like 5.4.0-169 → 5.4.0-26 now actually boot the target)
- Old-mainline URL fallback in pin-mainline (≤ 4.15 debs at /v$KVER/ not /amd64/)

mutagen_astronomy marked manual: true — mainline 4.14.70 kernel-panics on
Ubuntu 18.04's rootfs ('Failed to execute /init (error -8)' — kernel config
mismatch). Genuinely needs a CentOS 6 / Debian 7 image.

tools/verify-vm/provisioners/udisks_libblockdev.sh

@@ -9,7 +9,7 @@
 set -e
 
 export DEBIAN_FRONTEND=noninteractive
-apt-get install -y -qq udisks2 libblockdev-utils3 >/dev/null
+apt-get install -y -qq udisks2 libblockdev-utils2 >/dev/null
 
 mkdir -p /etc/polkit-1/rules.d
 cat >/etc/polkit-1/rules.d/49-skk-verify.rules <<'EOF'
@@ -31,4 +31,4 @@ sleep 2
 echo "[+] udisks2 status:"
 systemctl is-active udisks2.service
 echo "[+] udisks2 version: $(dpkg-query -W -f='${Version}' udisks2)"
-echo "[+] libblockdev version: $(dpkg-query -W -f='${Version}' libblockdev-utils3 2>/dev/null || dpkg-query -W -f='${Version}' libblockdev-utils2)"
+echo "[+] libblockdev version: $(dpkg-query -W -f='${Version}' libblockdev-utils2)"