fix: verify device identity before publishing volume

[victorlane]

Problem

NodePublishVolume trusts the device path from PublishContext verbatim. waitDeviceReady only checks that the /dev/disk/by-id path exists, not that it points at the requested volume. The symlinks are maintained asynchronously by udev, so at boot with several volumes attaching, a path can resolve to another volume's block device.

Publish then proceeds on the wrong device:

• If it carries a filesystem, it is mounted and two volumes share one disk (NodePublishVolume can mount the wrong volume: waitDeviceReady only checks that the by-id path exists #1455, production incident with SELinux lockout and cross-volume writes).
• If blkid finds no filesystem, it is formatted. The data is destroyed even when the subsequent mount fails. Same outcome as Volume data destroyed — blkid incorrectly reports formatted ext4 volume as unformatted after node migration, triggering mkfs #1346, reached through a different route.

Both were reproduced against current main at the Publish level (mkfs ran and zeroed a data-carrying aliased device).

Fix

After the existing stat check, resolve the symlink and compare the device's SCSI serial (/sys/block/<dev>/device/vpd_pg80, which Hetzner sets to the volume ID) against the ID in the path. A mismatch is retried inside the existing backoff loop, treating a stale symlink like one that does not exist yet, and ends in ErrDeviceMismatch instead of a wrong mount.

Verification fails open: non Hetzner paths, LUKS mappings, or an unreadable VPD page skip the check, so a mount that cannot be verified is never blocked. The VPD layout (4 byte header, then the volume ID) was confirmed against production nodes.

Tests

• TestPublishRejectsAliasedDevice: aliased by-id path at the Publish entry point, asserts ErrDeviceMismatch and that the aliased device's data is untouched. Needs a writable /dev, skips otherwise.
• TestVerifyDeviceSerial: match, mismatch, kernel padded serial, unverifiable device.
• TestVerifyDeviceIdentitySkipsForeignPaths: LUKS mappings and the sanity tests' fake devpath are never rejected.

Full suite passes; go vet and gofmt clean.

Refs #1455

This PR (and code) were written using Claude Opus 5 assistance

[lukasmetzner]

Hey, before going any further, please have a quick look at our contributing guideline, in particular the AI/LLM policy: https://github.com/hetznercloud/csi-driver?tab=contributing-ov-file#ai--llm-policy

I suspect this PR was created with the assistance of an AI tool, but this was not disclosed.

[codecov]

Codecov Report

❌ Patch coverage is 52.00000% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 41.25%. Comparing base (e8812c3) to head (aa2f815).

Files with missing lines	Patch %	Lines
internal/volumes/mount.go	52.00%	12 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #1456       +/-   ##
===========================================
- Coverage   72.13%   41.25%   -30.89%     
===========================================
  Files          17       17               
  Lines        1529     1549       +20     
===========================================
- Hits         1103      639      -464     
- Misses        337      883      +546     
+ Partials       89       27       -62     

Flag	Coverage Δ
e2e-controller	?
e2e-node	?
integration	?
unit	41.25% <52.00%> (+0.31%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[lukasmetzner]

Test / kubernetes * (pull_request) Test / nomad * (pull_request) failing is expected.

[victorlane]

Hey, before going any further, please have a quick look at our contributing guideline, in particular the AI/LLM policy: https://github.com/hetznercloud/csi-driver?tab=contributing-ov-file#ai--llm-policy

I suspect this PR was created with the assistance of an AI tool, but this was not disclosed.

Added it