qemu: device-sim bringup — boot smoke, A/B disk harness, virt kernel variant

The third simulator (deliberately not named "sim"): a QEMU -M virt VM that
boots the real 6.18.46 kernel and enters at -kernel zImage — everything below
(BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM
and is explicitly out of scope.

- qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/
- qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical
  12-partition blkdevparts A/B layout (vda == mmcblk0 mapping)
- qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents,
  whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem
  mounts, slirp networking, payload daemon start)
- qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display
- qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in
  build/build-kernel.sh (canonical RV1106 build untouched when unset):
  adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input
- qemu/tests/boot-smoke.sh: sentinel-asserting boot test

Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the
feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full
stack boots both slots; 12 by-name symlinks; userdata persists across
reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

build/build-kernel.sh

@@ -12,6 +12,9 @@
 #   SDK_TC           dir holding the arm-rockchip830 uclibc cross toolchain bin/
 #   WORK             build scratch dir (default: a mktemp under $TMPDIR)
 #   JOBS             parallel make jobs (default: nproc)
+#   WARDEN_KCONFIG_FRAGMENT
+#                    optional kconfig fragment merged onto warden_defconfig
+#                    (qemu/configs/virt.fragment builds the QEMU -M virt variant)
 #
 # Requires: `python` (not python3) on PATH — the SDK quirk; the CI runner provides
 # a project-local venv. Builds are SERIAL on the shared SDK box — never run two.
@@ -97,6 +100,19 @@ log "patch series applied ($(basename "$SENTINEL") present)"
 # 4. configure
 log "configuring (warden_defconfig)"
 cp "$HERE/warden_defconfig" "$SRC/.config"
+# Optional kconfig fragment overlay (e.g. qemu/configs/virt.fragment for the
+# QEMU -M virt device-sim variant). Fail closed if set but unreadable — never
+# silently build the wrong kernel. Unset => the canonical RV1106 build,
+# byte-identical to a build without this hook.
+if [ -n "${WARDEN_KCONFIG_FRAGMENT:-}" ]; then
+  [ -f "$WARDEN_KCONFIG_FRAGMENT" ] || {
+    echo "FATAL: WARDEN_KCONFIG_FRAGMENT set but not a file: $WARDEN_KCONFIG_FRAGMENT" >&2
+    exit 1
+  }
+  FRAG="$(cd "$(dirname "$WARDEN_KCONFIG_FRAGMENT")" && pwd)/$(basename "$WARDEN_KCONFIG_FRAGMENT")"
+  log "merging kconfig fragment $(basename "$FRAG")"
+  ( cd "$SRC" && ARCH=arm ./scripts/kconfig/merge_config.sh -m .config "$FRAG" )
+fi
 # CROSS_COMPILE defaults to the Luckfox SDK uclibc prefix (set SDK_TC to its bin/),
 # but the kernel is freestanding, so a caller may override with a generic arm cross
 # toolchain instead — e.g. CROSS_COMPILE=arm-linux-gnueabihf- (in Debian's