M4: CLI polish — version flag, mountpoint override, stable aliases

Add --version flag with build-time injection via ldflags. Add
--mountpoint/-m flag to mount for one-off mount point override. Change
init aliases from device path basename (sda1) to UUID prefix (b8b2f8e3)
for stability across boots. Add .gitignore. Update flake.nix with
version injection.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mount.go

@@ -12,6 +12,8 @@ import (
 	"golang.org/x/term"
 )
 
+var mountpoint string
+
 var mountCmd = &cobra.Command{
 	Use:   "mount <device|alias>",
 	Short: "Unlock and mount a LUKS volume",
@@ -20,6 +22,7 @@ var mountCmd = &cobra.Command{
 }
 
 func init() {
+	mountCmd.Flags().StringVarP(&mountpoint, "mountpoint", "m", "", "mount point override (privileged path only)")
 	rootCmd.AddCommand(mountCmd)
 }
 
@@ -35,6 +38,12 @@ func runMount(cmd *cobra.Command, args []string) error {
 
 	devCfg := cfg.ResolveDevice(target)
 
+	// CLI flag overrides config mountpoint.
+	mp := devCfg.Mountpoint
+	if mountpoint != "" {
+		mp = mountpoint
+	}
+
 	dev, err := client.FindDevice(devCfg.UUID, target)
 	if err != nil {
 		return err
@@ -43,12 +52,12 @@ func runMount(cmd *cobra.Command, args []string) error {
 	// Check if already unlocked.
 	if cleartext, err := client.CleartextDevice(dev); err == nil {
 		// Already unlocked — check if mounted too.
-		if mp, mounted := client.IsMounted(cleartext); mounted {
-			fmt.Println(mp)
+		if existing, mounted := client.IsMounted(cleartext); mounted {
+			fmt.Println(existing)
 			return nil
 		}
 		// Unlocked but not mounted — just mount it.
-		return doMount(client, cleartext, devCfg)
+		return doMount(client, cleartext, mp)
 	}
 
 	// Need to unlock.
@@ -63,23 +72,35 @@ func runMount(cmd *cobra.Command, args []string) error {
 	}
 
 	if result.Privileged {
-		mountpoint, err := cryptsetup.Mount(result.Device.DevicePath, devCfg.Mountpoint)
+		mnt, err := cryptsetup.Mount(result.Device.DevicePath, mp)
 		if err != nil {
 			return fmt.Errorf("mounting: %w", err)
 		}
-		fmt.Println(mountpoint)
+		fmt.Println(mnt)
 		return nil
 	}
 
-	return doMount(client, result.Device, devCfg)
+	if mp != "" {
+		fmt.Fprintf(os.Stderr, "warning: --mountpoint is ignored for udisks2 mounts (passphrase/keyfile path)\n")
+	}
+	return doMount(client, result.Device, "")
 }
 
-func doMount(client *udisks.Client, cleartext *udisks.BlockDevice, devCfg config.ResolvedDevice) error {
-	mountpoint, err := client.Mount(cleartext)
+func doMount(client *udisks.Client, cleartext *udisks.BlockDevice, mp string) error {
+	if mp != "" {
+		// udisks2 doesn't support custom mount points; use privileged mount.
+		mnt, err := cryptsetup.Mount(cleartext.DevicePath, mp)
+		if err != nil {
+			return fmt.Errorf("mounting: %w", err)
+		}
+		fmt.Println(mnt)
+		return nil
+	}
+	mnt, err := client.Mount(cleartext)
 	if err != nil {
 		return fmt.Errorf("mounting: %w", err)
 	}
-	fmt.Println(mountpoint)
+	fmt.Println(mnt)
 	return nil
 }