qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

.github/workflows/ci.yml

@@ -110,7 +110,16 @@ jobs:
           sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
           shellcheck -x qemu/*.sh qemu/tests/*.sh build/*.sh \
             qemu/rootfs/etc/warden-lib.sh qemu/rootfs/etc/rc \
-            qemu/rootfs/sbin/init qemu/rootfs/init
+            qemu/rootfs/sbin/init qemu/rootfs/init tests/mk-bootimg/*.sh \
+            tests/fetch-vendor/*.sh tests/fetch-buildroot-tarball/*.sh
+      - name: cache apt archives (python3-pil)
+        # Same cost class as the busybox binary cached below: a system package
+        # plus its libjpeg/libpng transitive deps, downloaded fresh on every
+        # push otherwise.
+        uses: actions/cache@v4
+        with:
+          path: /var/cache/apt/archives
+          key: apt-archives-python3-pil-${{ runner.os }}
       - name: ui-drive driver and image tools (offline)
         # qmp.py's drive() with QMP and the control channel faked, plus
         # imgtools' self-test: the per-step ok/fail/fatal contract and the
@@ -119,6 +128,59 @@ jobs:
           sudo apt-get install -y -qq python3-pil
           python3 qemu/tests/imgtools.py selftest
           python3 qemu/tests/test_qmp_drive.py
+      - name: imgtools bench (smoke, printed for trend-watching)
+        # Same pattern as the sim/rs485-bridge bench job above: no stored
+        # baseline yet, just a number in the log so a phash/structural
+        # regression (DCT size, downscale filter, occupancy thresholds)
+        # is visible instead of only showing up as an unexplained slower
+        # flow run later.
+        run: python3 qemu/tests/imgtools.py bench
+      - name: mk-bootimg probe regression tests
+        # Guards issue #17 (mkimage's non-zero exit sinking the probe's grep
+        # pipeline under set -o pipefail) on every push/PR, not only on the
+        # next workflow_dispatch that happens to exercise mk-bootimg.sh for
+        # real via kernel-build.
+        run: bash tests/mk-bootimg/run-probe-tests.sh
+      - name: run.sh argv ordering regression test
+        # Pins the CTL-before-RS485 pci-serial argv order that
+        # rootfs/sbin/init's ttyS0-vs-ttyS1 alias depends on: a swap here
+        # reproduces run.sh:131-133's own incident, Modbus frames landing
+        # on the debug channel. All offline (a stub qemu-system-arm on
+        # PATH), so it runs on every push/PR, not only a real boot.
+        run: bash qemu/tests/run-sh-args-test.sh
+      - name: mkimage.sh SEED_DIR regression test
+        # Only ui-drive.sh --seed (a real VM boot) exercises this hook
+        # otherwise; this builds the same unprivileged mkfs.ext4 image and
+        # reads it back with debugfs, no VM needed.
+        run: bash qemu/tests/seed-dir.sh
+      - name: qemu_stage_rootfs permission regression test
+        # Git tracks only the executable bit, so a fresh checkout can land
+        # the source etc/shadow world-readable under a permissive umask;
+        # this pins the staged copy at 0600 regardless of the source mode.
+        run: bash qemu/tests/stage-rootfs-perms.sh
+      - name: fetch-vendor regression tests
+        # --check state machine (MISSING/OK/DRIFTED), --help, and the
+        # clone stall guard, against local throwaway repos: no network.
+        run: bash tests/fetch-vendor/run-fetch-vendor-tests.sh
+      - name: fetch-buildroot-tarball regression tests
+        # Retry-on-mismatch, cleanup, and the already-verified
+        # short-circuit, against a fake curl on PATH: no network.
+        run: bash tests/fetch-buildroot-tarball/run-fetch-buildroot-tarball-tests.sh
+      - name: mk-bootimg boot.img validation regression tests
+        # Guards issue #22 (a missing/erroring fdtget silently skipping the
+        # data-position check) plus the FIT metadata and per-image
+        # data-position %512 checks and the embedded-data-FIT check.
+        run: bash tests/mk-bootimg/run-boot-img-validate-tests.sh
+      - name: mk-bootimg --help regression test
+        # Pins --help against its own header comment so a hardcoded line
+        # range can't silently start printing code again the next time the
+        # header grows or shrinks (the bug fetch-vendor.sh's --help had).
+        run: bash tests/mk-bootimg/run-help-tests.sh
+      - name: qemu-tools CI wiring regression test
+        # Catches a regression test shipping in this job without this job
+        # ever calling it -- the exact gap run-probe-tests.sh sat in before
+        # the step above wired it in.
+        run: bash tests/mk-bootimg/run-ci-wiring-tests.sh
       - name: cache pinned busybox
         uses: actions/cache@v4
         with: