qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

kernel/rv1106-enablement/PORT-STATUS.md

@@ -160,16 +160,18 @@ build-m2.sh reproducible M2 build (zImage + dtb)
 The full ported tree lives in `flare-edge/research/linux-6.18.46/` (scratch); this dir is
 the durable, reviewable capture, to become a proper patch series as milestones land.
 
-## Hardware verification of the CURRENT series (2026-09-03, bench panel)
+## Hardware verification (2026-09-03)
 
-The series in `../../patches/` was built with `build/build-kernel.sh` +
+The current series in `../../patches/` was built with `build/build-kernel.sh` +
 `build/warden_defconfig` (rockchip gcc 8.3), packaged with the new
 `build/mk-bootimg.sh`, flashed to the bench panel's inactive slot armed for a
 single try, and booted. Working on real silicon: display (`/dev/fb0`,
 `/dev/dri/card0`), backlight, Goodix touch, RGA (`/dev/rga`), eth0, the usb0
 gadget, all userspace daemons, and zero kernel faults in dmesg.
 
-M4/M5/M6 above are STALE: display and RGA are in the series and verified here.
+M4 (display) and part of M6 (RGA) above are STALE: both are in the series and
+verified here. M5 (wifi) and the rest of M6 (watchdog, HPMCU, full USB-OTG
+dual role) are still open -- this run gives no evidence for them.
 
 **What the same test found missing, and why it matters.** Diffing this
 defconfig's expansion against the kernel actually shipping on a panel showed