qemu: rs485 silence|restore takes a simulated device off the bus mid-run

ui-drive.sh --rs485-devices fixed the roster for the whole boot, so no
script could show the guest noticing a device go quiet. mbsim.py now
serves a control socket (flare-edge --control); ui-drive.sh opens it next
to the pty and hands its path to qmp.py drive (--rs485-control), whose new
verb `rs485 silence|restore ADDR` sends one command and judges the reply.
A run without a simulated bus records the step as fatal rather than a
silent pass. Rig: unit 5 silenced reads online=false after 65 s in the
status json, restored reads online=true after 64 s (flare-edge #184).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

qemu/tests/ui-drive.sh

@@ -166,7 +166,9 @@ if [ -n "$RS485_DEVICES" ]; then
   dev_args=()
   IFS=',' read -r -a _devs <<< "$RS485_DEVICES"
   for d in "${_devs[@]}"; do dev_args+=(--device "$d"); done
-  python3 "$FLARE_EDGE/tools/modbus-sim/mbsim.py" --port "$WORK/rs.pty" "${dev_args[@]}" > "$WORK/mbsim.log" 2>&1 &
+  # --control is the runtime lever: qmp.py's `rs485 silence|restore ADDR`
+  # verb talks to it, so a flow can take a device off the bus mid-run.
+  python3 "$FLARE_EDGE/tools/modbus-sim/mbsim.py" --port "$WORK/rs.pty" --control "$WORK/rs.ctl" "${dev_args[@]}" > "$WORK/mbsim.log" 2>&1 &
   SIM_PIDS="$SIM_PIDS $!"
   echo "== rs485 simulator: $RS485_DEVICES on $WORK/rs.pty"
 fi
@@ -235,6 +237,7 @@ DRIVE_ARGS=(--ctl "$WORK/ctl.sock" --console "$WORK/console.log")
 # default in two places.
 [ -n "$REFS_FILE" ] && DRIVE_ARGS+=(--refs "$REFS_FILE")
 python3 "$HERE/qmp.py" "$WORK/qmp.sock" drive "$SCRIPT" "$OUTDIR" \
+  ${RS485_DEVICES:+--rs485-control "$WORK/rs.ctl"} \
   "${DRIVE_ARGS[@]}" || drive_rc=$?
 
 # The UI must still be alive: see the header. The driver checks this after