qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

qemu/mkimage.sh

@@ -99,6 +99,38 @@ done
 # same-named --state value; `cp -a` preserves the 0600 on a secret entry.
 if [ -n "${SEED_DIR:-}" ]; then
   [ -d "$SEED_DIR" ] || { echo "FATAL: SEED_DIR '$SEED_DIR' is not a directory" >&2; exit 1; }
+  # Validate every entry before cp -a touches any of them: `cp -a` preserves
+  # a symlink rather than following it, so one placed in SEED_DIR would land
+  # as a live symlink under /userdata/warden that a later read (flared's
+  # settings loader, running inside the guest) resolves through. Fail closed
+  # on the first bad entry the same way --state fails closed above, rather
+  # than copy it into the image and let it surface as a confusing read
+  # later. Only a top-level plain file matches "one file per settings key"
+  # (the Env note above) -- seed-fixtures.py never nests a subdirectory, and
+  # neither should anything else pointed at this hook.
+  #
+  # Charset is seed-fixtures.py's KEY_RE, not --state's stricter
+  # [A-Za-z0-9_.]+ above: seed-fixtures.py deliberately also allows '-' for
+  # keys like "gas-plant.devices" (flare-edge#151), and committed flow
+  # specs (gas_compression, gas_plant, liquid_pumping, power_generation)
+  # already seed hyphenated keys through this exact path -- --state's
+  # charset would reject every one of them.
+  while IFS= read -r -d '' entry; do
+    base="$(basename "$entry")"
+    case "$base" in
+      *[!A-Za-z0-9_.-]*)
+        echo "FATAL: SEED_DIR entry '$base' must match [A-Za-z0-9_.-]+ (it becomes a filename)" >&2
+        exit 1 ;;
+    esac
+    if [ -L "$entry" ]; then
+      echo "FATAL: SEED_DIR entry '$base' is a symlink (refusing to copy it into userdata verbatim)" >&2
+      exit 1
+    fi
+    [ -f "$entry" ] || {
+      echo "FATAL: SEED_DIR entry '$base' is not a plain file (refusing to copy it into userdata verbatim)" >&2
+      exit 1
+    }
+  done < <(find "$SEED_DIR" -mindepth 1 -maxdepth 1 -print0)
   cp -a "$SEED_DIR"/. "$UDATA/warden/"
 fi