qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

qemu/lib.sh

@@ -44,6 +44,12 @@ qemu_stage_rootfs() {
   cp -a "$QEMU_DIR/rootfs/." "$root/"
   chmod 0755 "$root/init" "$root/sbin/init" "$root/etc/rc" \
              "$root/usr/share/udhcpc/default.script"
+  # git only tracks the executable bit, so a checkout lands etc/shadow at
+  # whatever the umask gives a non-executable file (644 under the common
+  # 022) -- root's crypt hash world-readable. Force the normal shadow mode
+  # here, once, for every caller (mkimage.sh and mkinitramfs.sh both stage
+  # through this function).
+  chmod 0600 "$root/etc/shadow"
 }
 
 # Parse a "SIZE[@OFFSET](NAME)" blkdevparts entry list (without the "vda:"