qemu: two tests the review pass left on disk

tests/scripts/fullscreen-toggle-tracks-real-state.txt pins the debug
channel's `fullscreen toggle` deciding from the dashboard's real state
rather than a private flag that `home` and a real tap left stale (rig:
14 ok). tests/test-ui-drive-rs485.sh runs offline with a fake run.sh and
socat and proves ui-drive.sh --rs485-devices fails closed when the
socket, pty or control socket never appears, dumps mbsim.log on failure,
and kills a simulator that ignores SIGTERM. README lists both.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

qemu/tests/scripts/fullscreen-toggle-tracks-real-state.txt

@@ -0,0 +1,39 @@
+# `fullscreen toggle` must read the dashboard's REAL state, not a belief the
+# FIFO's own `fullscreen` verb tracked on the side.
+#
+# warden_debug.c's `fullscreen` command used to keep a private `static bool
+# on` as its only record of state, and nothing kept it in step with the real
+# dashboard: `home` clears fullscreen by calling
+# warden_screen_overview_set_fullscreen(false) directly (every hardware run's
+# preamble, since a live panel is wherever the last flow or an operator left
+# it), and a real tap on the dashboard toggles it through the UI's own
+# tap-catcher. Either way the FIFO's belief was left stale. A `fullscreen
+# toggle` right after either one then decided its next state from that stale
+# belief: if `on` was still true from an earlier `fullscreen on`, toggling
+# set it to false -- which coincidentally MATCHED the already-off real state,
+# so the dashboard never actually turned on, yet the reply still said
+# "fullscreen off: ok". See test_qmp_drive.py's FullscreenToggleTracksRealState
+# for the same scenario driven offline against a faked control channel (both
+# the pre-fix and fixed shapes).
+#
+# `wake` first, as every compiled flow does: by the time the control bridge
+# is up the rig may already sit dimmed, and sleep.c swallows the touch that
+# wakes a dimmed panel (flare-edge #148).
+wake
+sleep 1
+assert_page Dashboard/Dashboard
+assert_hit 47 676 obj box=12,640,72x72
+ctl fullscreen on
+sleep 1
+assert_hit 47 676 widget box=0,0,720x720
+home
+sleep 1
+assert_page Dashboard/Dashboard
+# home must have cleared the REAL state -- this is home-leaves-fullscreen.txt's
+# own check, repeated here so a failure below is unambiguously the toggle's
+# fault and not a home regression.
+assert_hit 47 676 obj box=12,640,72x72
+# The dashboard is really off now. A correct toggle from here can only go on.
+ctl fullscreen toggle
+sleep 1
+assert_hit 47 676 widget box=0,0,720x720