isRemovableDestination

Best-effort check that destinationUri names a location on removable storage — i.e. plausibly a mounted UF2 bootloader drive rather than internal storage.

Used to reject the Downloads mistake before writing, which matters only once a write is destructive: in a multi-pass maintenance sequence a mis-saved pass leaves the device with no application, and nothing else in the flow can tell a landed write from a lost one. The plain single-pass update path deliberately does not consult this — its worst case is "nothing happened, replug".