qemu: display + touch scenario, ADR-0006, docs

Phase 4+5 of the device sim:

- Display + touch verified end-to-end: virtio-gpu at 720x720 (fbdev
  emulation) renders the real WardenOS dashboard from the static LVGL
  fbdev+evdev UI build (flare-edge qemu-vm-support tools/build-ui-vm.sh);
  QMP input-send-event taps the Metrics tab and qemu/tests/ui-shot.sh
  asserts the repaint from screendumps. Two load-bearing QEMU flags found
  and documented: -global virtio-mmio.force-legacy=false (gpu/input are
  VERSION_1-only) and the 200ms press hold (an instantaneous press+release
  lands inside one LVGL indev poll and never clicks).
- qemu/tests/qmp.py: minimal QMP client (screendump, tap, quit).
- stage-2 init starts warden-ui when present and fb0 exists.
- docs/decisions/0006-qemu-device-sim.md: virt-not-custom-board, the
  enters-at-kernel boundary, fragment policy, naming, consequences.
- docs/architecture.md: new section 7 (device emulation), order-of-work
  item 7; modbus cross-reference to the bridge.
- qemu/README.md: emulated-vs-not table, scenarios, gotchas, host/runner
  requirements. docs/ci-cd.md: runner needs one-time qemu-system-arm
  install (fail-closed smoke until then, [maintainer]-gated). Repo README updated.

Final sweep on this commit: shellcheck clean, bridge 7/7 tests, boot smoke
PASS, portal scenario PASS (check-in + fw pull + signed .wfw download),
ui-shot PASS (touch navigates to Metrics) — all under the final flags.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

README.md

@@ -12,12 +12,14 @@ the rest of the firmware: tested, benchmarked, reproducible, and honest about
 what runs on real silicon versus what we simulate.
 
 > Status: **bringup.** The hardware **simulator** and its tests, the RV1106 kernel
-> forward-port as a reviewable `patches/` series, the hermetic kernel build, and two
-> Tier-1 drivers at 100% MC/DC are all in and CI-green on `main`. What
-> remains before this is on the production build path: installing the self-hosted
-> kernel-build runner (see `docs/ci-cd.md`) and having flare-edge consume warden-sdk
-> as a dependency — both [maintainer]-gated. Until then, flare-edge still builds firmware from
-> the vendored SDK + `sdk-patches/`.
+> forward-port as a reviewable `patches/` series, the hermetic kernel build, two
+> Tier-1 drivers at 100% MC/DC, and the **QEMU device sim** (`qemu/`, ADR-0006:
+> boots the real kernel + real userspace on `-M virt` — check-in/OTA against the
+> mock portal, watchdog, RS485-to-sim bridge, 720x720 display + touch, all
+> emulation-verified) are in. What remains before this is on the production build
+> path: qemu-system-arm on the kernel-build runner (see `docs/ci-cd.md` §5) and
+> having flare-edge consume warden-sdk as a dependency — both [maintainer]-gated. Until
+> then, flare-edge still builds firmware from the vendored SDK + `sdk-patches/`.
 
 ## Why a new SDK
 
@@ -90,6 +92,8 @@ than duplicate each other.
 
 ```
 sim/        the hardware simulator (Rust): membus/devmem, HPMCU, CRU, Modbus, RGA, NPU.
+qemu/       the device simulator (ADR-0006): QEMU -M virt boots the real kernel and
+            real userspace; A/B disk layout, RS485 bridge into sim/, scenario tests.
 drivers/    our own hardened drivers + their seams (relays, freshness; more migrate in).
 patches/    the RV1106 kernel forward-port delta onto pristine linux-6.18.46 (subsystem-split).
 kernel/     forward-port docs + provenance (rv1106-enablement/, PROVENANCE.md).