qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

build/fetch-vendor.sh

@@ -26,7 +26,11 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --check) MODE="check"; shift ;;
     --fetch) MODE="fetch"; shift ;;
-    -h|--help) sed -n '2,18p' "$0"; exit 0 ;;
+    # Print the header comment (line 1 is the shebang, so start at 2) and
+    # stop at the first line of code rather than a hardcoded line count --
+    # a fixed range silently starts printing code again the next time the
+    # header comment grows or shrinks.
+    -h|--help) awk '/^set /{exit} NR>1{print}' "$0"; exit 0 ;;
     *) DIR="$1"; shift ;;
   esac
 done
@@ -34,6 +38,19 @@ done
 [ -r "$MANIFEST" ] || { echo "FATAL: no manifest at $MANIFEST" >&2; exit 1; }
 command -v git >/dev/null || { echo "FATAL: git not on PATH" >&2; exit 1; }
 
+# A stalled clone (dead peer, wedged proxy) must not hang this script forever
+# with no way for a caller to tell "still working" from "wedged" -- the
+# luckfox-pico tree alone is ~21 GB, so a plain wall-clock timeout would also
+# abort a clone that is merely slow. Abort only on a stall instead: git's http
+# transport already aborts a transfer whose average speed drops below
+# LOW_SPEED_LIMIT bytes/sec for LOW_SPEED_TIME seconds straight, so a slow but
+# progressing clone is never penalized. Both are overridable for a link that
+# is legitimately slow.
+: "${WARDEN_VENDOR_LOW_SPEED_LIMIT:=1000}"
+: "${WARDEN_VENDOR_LOW_SPEED_TIME:=60}"
+export GIT_HTTP_LOW_SPEED_LIMIT="$WARDEN_VENDOR_LOW_SPEED_LIMIT"
+export GIT_HTTP_LOW_SPEED_TIME="$WARDEN_VENDOR_LOW_SPEED_TIME"
+
 if [ -z "$DIR" ]; then
   DIR="${WARDEN_VENDOR_DIR:-$HOME/projects/scada/flare-edge}"
 fi