qemu: device-sim bringup — boot smoke, A/B disk harness, virt kernel variant

The third simulator (deliberately not named "sim"): a QEMU -M virt VM that
boots the real 6.18.46 kernel and enters at -kernel zImage — everything below
(BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM
and is explicitly out of scope.

- qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/
- qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical
  12-partition blkdevparts A/B layout (vda == mmcblk0 mapping)
- qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents,
  whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem
  mounts, slirp networking, payload daemon start)
- qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display
- qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in
  build/build-kernel.sh (canonical RV1106 build untouched when unset):
  adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input
- qemu/tests/boot-smoke.sh: sentinel-asserting boot test

Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the
feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full
stack boots both slots; 12 by-name symlinks; userdata persists across
reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/README.md

@@ -0,0 +1,47 @@
+# qemu/ — the WardenOS device simulator
+
+A QEMU virtual machine that boots the real forward-ported kernel (`build/` +
+`patches/`) and real userspace, so the *device* — init, daemons, networking,
+OTA, watchdog — can be tested off-hardware. The third simulator in the stack,
+deliberately not named "sim":
+
+- `lvglsim` (flare-edge) — SDL desktop build of the UI. Rendering only.
+- `sim/` (this repo) — register-level Rust models of RV1106 blocks behind
+  driver seams.
+- `qemu/` (this) — the whole machine above the kernel entry point.
+
+## The boundary (read this before trusting a green run)
+
+There is no RV1106 machine model in QEMU and everything below the kernel is
+closed rkbin blobs plus mask ROM, so the VM **enters at `-kernel zImage`** on
+`-M virt` (generic ARMv7 machine, virtio peripherals). That means:
+
+- **Not emulated, not tested here:** BootROM, idblock/DDR-init, SPL, U-Boot,
+  the real BCB-driven A/B slot selection, bootcount auto-revert. The untested
+  A/B rollback chain stays untested by this tool.
+- **Substituted, not modeled:** display (virtio-gpu, not VOP), input
+  (virtio-tablet, not GT911), network (virtio-net, not GMAC), storage
+  (virtio-blk, not eMMC). NPU/RGA/HPMCU behavior stays `sim/` territory.
+- "Boots under emulation" is **not** "works on silicon". On-device claims
+  still need on-device evidence; the VM narrows which claims need a panel.
+
+## Quick start
+
+```sh
+# 1. build the QEMU kernel variant (canonical RV1106 build + virt fragment)
+WORK=$HOME/kbuild-out CROSS_COMPILE=arm-linux-gnueabihf- \
+  WARDEN_KCONFIG_FRAGMENT=qemu/configs/virt.fragment bash build/build-kernel.sh
+
+# 2. build the initramfs (sha256-pinned static busybox + qemu/rootfs/)
+bash qemu/mkinitramfs.sh
+
+# 3. smoke it
+bash qemu/tests/boot-smoke.sh $HOME/kbuild-out/linux-6.18.46/arch/arm/boot/zImage
+```
+
+Host requirements: `qemu-system-arm` (Debian 13 ships QEMU 10), `curl`, `cpio`,
+`gcc-arm-linux-gnueabihf` for the kernel build.
+
+Status: bringup — boot smoke only. Disk/network harness, RS485 bridge to
+`sim/`, portal scenarios, and display/touch land in later phases (see
+`docs/decisions/0006-qemu-device-sim.md` once written).