qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

build/warden_defconfig

@@ -1351,7 +1351,14 @@ CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
 CONFIG_NETFILTER_XT_NAT=y
 CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
 CONFIG_NF_DEFRAG_IPV4=y
-CONFIG_NF_CONNTRACK_IPV4=y
+# No NF_CONNTRACK_IPV4 symbol here -- IPv4 conntrack has been unconditional in
+# NF_CONNTRACK's core since well before 6.18 (net/ipv4/netfilter/Kconfig has no
+# such config). Only stale arch defconfigs (e.g. keystone_defconfig) still set
+# it; Kconfig drops an unknown symbol with no warning, so it looked live but
+# did nothing. Left out on purpose so this file does not claim a gate that
+# does not exist. If a future kernel bump reintroduces a real symbol by this
+# name, catch it by diffing the expanded .config, not by functional test alone
+# -- see PORT-STATUS.md's own history of a silent-drop hiding a real gap.
 CONFIG_IP_NF_IPTABLES=y
 # 6.18 SPLIT THE LEGACY TABLES OUT. IP_NF_FILTER and IP_NF_NAT depend on
 # IP_NF_IPTABLES_LEGACY, which did not exist in 5.10 -- so copying the vendor