qemu and build: review fixes across the rig driver, boot script, and fetch helpers

Bounded waits and validated arguments in run.sh and ui-drive.sh, a seeded
settings directory and root-only staged rootfs permissions with their own
tests, qmp.py and imgtools.py hardening, the fetch scripts checking what they
download, and ASCII typography throughout. Each fix carries its test under
qemu/tests or tests/.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

tests/mk-bootimg/run-ci-wiring-tests.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+# Regression test: every offline regression-test script this job ships must
+# actually be invoked by the qemu-tools CI job, not just committed.
+#
+# run-probe-tests.sh (guards issue #17) sat in the tree unwired into
+# .github/workflows/ci.yml: it passed by hand but ran nowhere in CI, so a
+# regression in the mkimage probe would only have surfaced on the next
+# workflow_dispatch kernel build, not on every push/PR. The same gap later
+# reopened for six more scripts written the same way, so this now checks
+# every one of them (including itself) instead of only the first: it
+# isolates the qemu-tools job and checks each script's basename appears in
+# its steps.
+set -uo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+CI_YML="$HERE/../../.github/workflows/ci.yml"
+
+[ -f "$CI_YML" ] || { echo "FAIL: no workflow file at $CI_YML"; exit 1; }
+
+# Isolate the qemu-tools job: from its own header line up to (but not
+# including) the next job at the same two-space indent.
+job="$(awk '
+    /^  qemu-tools:/ { inside = 1; print; next }
+    inside && /^  [A-Za-z0-9_-]+:/ { exit }
+    inside { print }
+' "$CI_YML")"
+
+[ -n "$job" ] || { echo "FAIL: qemu-tools job not found in $CI_YML"; exit 1; }
+
+# Every offline regression-test script the qemu-tools job owns. Add new
+# scripts here when they are written, not only when someone remembers to
+# wire them in -- that is the failure this test exists to catch.
+scripts=(
+    "tests/mk-bootimg/run-probe-tests.sh"
+    "qemu/tests/run-sh-args-test.sh"
+    "qemu/tests/seed-dir.sh"
+    "qemu/tests/stage-rootfs-perms.sh"
+    "tests/fetch-vendor/run-fetch-vendor-tests.sh"
+    "tests/fetch-buildroot-tarball/run-fetch-buildroot-tarball-tests.sh"
+    "tests/mk-bootimg/run-boot-img-validate-tests.sh"
+    "tests/mk-bootimg/run-help-tests.sh"
+    "tests/mk-bootimg/run-ci-wiring-tests.sh"
+)
+
+fail=0
+for s in "${scripts[@]}"; do
+    base="$(basename "$s")"
+    if echo "$job" | grep -q -- "$base"; then
+        echo "PASS: qemu-tools job invokes $s"
+    else
+        echo "FAIL: qemu-tools job never runs $s"
+        fail=1
+    fi
+done
+
+exit "$fail"