qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

build/mk-bootimg.sh

@@ -42,7 +42,12 @@ while [ $# -gt 0 ]; do
     # displays it on an ordinary boot.
     --logo-verbose)   LOGO_VERBOSE="${2:?}"; shift 2 ;;
     --resource-tool)  RTOOL="${2:?}"; shift 2 ;;
-    -h|--help)        sed -n '2,25p' "$0"; exit 0 ;;
+    # Print the header comment (line 1 is the shebang, so start at 2) and
+    # stop at the first line of code rather than a hardcoded line count --
+    # a fixed range silently starts printing code again the next time the
+    # header comment grows or shrinks (see build/fetch-vendor.sh's own
+    # --help, which had this exact bug).
+    -h|--help)        awk '/^set /{exit} NR>1{print}' "$0"; exit 0 ;;
     *) echo "FATAL: unknown argument '$1'" >&2; exit 1 ;;
   esac
 done
@@ -52,6 +57,11 @@ done
 [ -n "$OUT" ] || { echo "FATAL: --out is required" >&2; exit 1; }
 command -v mkimage >/dev/null || {
   echo "FATAL: mkimage not on PATH (Debian/Ubuntu: u-boot-tools)" >&2; exit 1; }
+# fdtget backs the post-build alignment assertions below (the whole point of
+# which is that a misaligned image boots fine in CI and fails on a panel), so
+# its absence must fail the build rather than silently skip those checks.
+command -v fdtget >/dev/null || {
+  echo "FATAL: fdtget not on PATH (Debian/Ubuntu: device-tree-compiler)" >&2; exit 1; }
 
 # resource_tool is a Rockchip host tool. It has no free-standing source here, so
 # it is taken from the vendor SDK when one is present rather than vendored as a
@@ -160,11 +170,6 @@ ITS
 #     vendor's -p value -- the absolute position of the first payload -- not an
 #     alignment.
 #
-#     The flag is feature-detected because the SDK vendors mkimage 2017.09,
-#     which has no -B at all and dies with "invalid option -- 'B'". Its packer
-#     already 512-aligns, so omitting the flag there is correct rather than a
-#     fallback. project/build.sh prepends the SDK tool dir to PATH, so that
-#     binary IS what a build inside the SDK environment resolves.
 #     A -B-capable mkimage is REQUIRED, not preferred. The SDK vendors 2017.09,
 #     which has no -B, and project/build.sh:64 puts it first on PATH -- so the
 #     wrong one is what a build inside the SDK environment picks up. Measured:
@@ -198,16 +203,24 @@ echo "== FIT (external data, -E -p 0x800 -B 0x200) using $MKIMAGE"
 
 # Assert what U-Boot actually requires, on every build: the failure is silent --
 # a misread offset does not fail the build, it fails on a panel, and sometimes
-# only as a missing logo.
-_meta="$(od -An -tu4 -j4 -N4 --endian=big "$WORKDIR/boot.img" | tr -d ' ')"
-if [ $(( _meta % 512 )) -ne 0 ]; then
-    echo "FATAL: FIT metadata is $_meta bytes, not a multiple of 512;" >&2
+# only as a missing logo. Computed once and reused below (the embedded-data-FIT
+# check further down needs the same value) so a future fix to how this is read
+# cannot land in one check and not the other.
+meta="$(od -An -tu4 -j4 -N4 --endian=big "$WORKDIR/boot.img" | tr -d ' ')"
+if [ $(( meta % 512 )) -ne 0 ]; then
+    echo "FATAL: FIT metadata is $meta bytes, not a multiple of 512;" >&2
     echo "       FIT_ALIGN would round it up and every payload reads late" >&2
     exit 1
 fi
 for _n in fdt kernel resource; do
-    _pos="$(fdtget -t u "$WORKDIR/boot.img" "/images/$_n" data-position 2>/dev/null || true)"
-    [ -n "$_pos" ] || continue
+    # fdtget's presence is checked up front; a failure here means the FIT this
+    # script just built is malformed, not that the field is legitimately
+    # absent (mkimage -E gives every one of these images a data-position). Fail
+    # loud rather than treat an empty read as nothing to check.
+    if ! _pos="$(fdtget -t u "$WORKDIR/boot.img" "/images/$_n" data-position 2>&1)"; then
+        echo "FATAL: fdtget could not read /images/$_n data-position: $_pos" >&2
+        exit 1
+    fi
     if [ $(( _pos % 512 )) -ne 0 ]; then
         echo "FATAL: /images/$_n data-position $_pos is not 512-aligned;" >&2
         echo "       U-Boot's truncating block divide would read the wrong offset" >&2
@@ -218,7 +231,6 @@ done
 # A FIT whose metadata swelled to the size of the whole image is an
 # embedded-data build, which this U-Boot rejects. Catch it here rather than on
 # a panel that will not come back.
-meta="$(od -An -tu4 -j4 -N4 --endian=big "$WORKDIR/boot.img" | tr -d ' ')"
 total="$(stat -c %s "$WORKDIR/boot.img")"
 if [ "${meta:-0}" -ge 4096 ] || [ "${meta:-0}" -ge "$total" ]; then
   echo "FATAL: FIT metadata is ${meta} bytes of a ${total}-byte image: that is an" >&2