qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

build/fetch-buildroot-tarball.sh

@@ -12,6 +12,14 @@
 # Same shape as fetch-kernel-tarball.sh, deliberately: a version bump edits this
 # file and the pin beside it, nothing else. FAILS CLOSED on a missing pin.
 #
+# Not wired into build-firmware.sh or CI yet -- tools/build-firmware.sh stages
+# sdk-patches/buildroot/ onto whatever buildroot tree the vendor SDK already
+# has, it does not yet extract this pinned tarball over it. Exercised today by
+# tests/fetch-buildroot-tarball/run-fetch-buildroot-tarball-tests.sh and by
+# running the script by hand; wiring it into the real build path is a separate
+# change (it has to reconcile the pristine tree with the existing SDK buildroot
+# checkout first).
+#
 # Usage: fetch-buildroot-tarball.sh <destination-path>
 set -euo pipefail
 
@@ -43,7 +51,11 @@ fi
 
 for attempt in 1 2 3; do
   echo "== fetching buildroot-$BRVER (attempt $attempt)"
-  if curl -fsSL --retry 2 -o "$TB" "$URL" && verify; then
+  # --retry only re-fires once curl decides a transfer has failed; a connection
+  # that opens and then stalls (blackholed route, hung proxy) never reaches
+  # that decision and would otherwise block forever. --connect-timeout bounds
+  # the handshake, --max-time bounds the whole request.
+  if curl -fsSL --retry 2 --connect-timeout 20 --max-time 120 -o "$TB" "$URL" && verify; then
     echo "buildroot-$BRVER: sha256 verified"
     exit 0
   fi