Support native SD storage and consolidate fds-flash tooling

Accept native SD cards for internal settings alongside legacy NVMe,
reject USB ancestry and ambiguous disks, and preserve read-only boot
loading with explicit recovery writes. Require built-in MMC drivers,
validate cached kernel configuration, and provide SD-only, SD-first and
USB-first EEPROM profiles.

Expose typed create and inspect commands through fds-flash, reuse the
existing cartridge creation code, and document the optional e2fsprogs
package dependency. Extend storage, EEPROM, flashing and hardware-test
coverage and advance the wiki reference to the published SD guide.

Validation: rootfs checks for CLI/development, boot matrix, internal
storage, EEPROM, flash, workstation, emulator, make check and wiki checks
passed. The full internal suite passed on an unchanged rerun after one
unexplained VM shutdown stall. Standalone init-test was blocked by its
unavailable pinned upstream kernel. Physical Pi checks remain pending.

Makefile

@@ -49,7 +49,7 @@ help:
 	  'make recovery           Build the independent recovery rootfs and EROFS payload' \
 	  'make recovery-test      Verify SYSTEM-independent recovery and DATA repair in ARM VMs' \
 	  'make internal-image     Assemble FDS_BOOT, FDS_RECOVERY and machine settings as one GPT disk' \
-	  'make internal-test      Verify virtual NVMe settings, persistence and rejection paths' \
+	  'make internal-test      Verify virtual SD/NVMe settings, persistence and rejection paths' \
 	  'make development-test   Compile, execute and debug C/C++/Rust in the development SYSTEM' \
 	  'make clock-test         Verify that native startup preserves a newer guest clock' \
 	  'make signing            Build the host release signer and static ARM verifier' \
@@ -226,6 +226,7 @@ internal-image:
 	./image/build-internal $(if $(MACHINE_CONFIG),--machine-config "$(MACHINE_CONFIG)") 2>&1 | tee out/logs/internal-build.log
 
 internal-test:
+	cargo test --locked --offline --target x86_64-unknown-linux-gnu -p fds-cli
 	python3 tests/integration/m12-internal.py 2>&1 | tee out/logs/internal-checks.log
 
 .PHONY: development-test clock-test