qemu: device-sim bringup — boot smoke, A/B disk harness, virt kernel variant

The third simulator (deliberately not named "sim"): a QEMU -M virt VM that
boots the real 6.18.46 kernel and enters at -kernel zImage — everything below
(BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM
and is explicitly out of scope.

- qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/
- qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical
  12-partition blkdevparts A/B layout (vda == mmcblk0 mapping)
- qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents,
  whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem
  mounts, slirp networking, payload daemon start)
- qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display
- qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in
  build/build-kernel.sh (canonical RV1106 build untouched when unset):
  adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input
- qemu/tests/boot-smoke.sh: sentinel-asserting boot test

Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the
feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full
stack boots both slots; 12 by-name symlinks; userdata persists across
reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/mkinitramfs.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# Build the QEMU device-sim initramfs: the pinned static busybox + qemu/rootfs/.
+# The busybox binary is the ONLY external input (sha256-pinned, fail-closed —
+# see qemu/lib.sh).
+#
+# Env:
+#   BUSYBOX   path to a local busybox binary (skips the download; still verified)
+#   OUT       output dir (default: qemu/out); initramfs at $OUT/initramfs.cpio.gz
+set -euo pipefail
+
+QEMU_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+. "$QEMU_DIR/lib.sh"
+OUT="${OUT:-$QEMU_DIR/out}"
+
+qemu_get_busybox
+
+# Assemble in a scratch dir, removed on exit (scratch-dir leaks were a past
+# review finding in this repo).
+SCRATCH="$(mktemp -d "${TMPDIR:-/tmp}/warden-qemu-initramfs.XXXXXX")"
+trap 'rm -rf "$SCRATCH"' EXIT
+qemu_stage_rootfs "$SCRATCH/root"
+
+# Pack (newc cpio, gzip). No device nodes required: /init mounts devtmpfs and
+# reopens the console itself, so the archive builds unprivileged.
+( cd "$SCRATCH/root" && find . -print0 | cpio -0 -o -H newc -R +0:+0 2>/dev/null ) \
+  | gzip -9 > "$OUT/initramfs.cpio.gz"
+qemu_log "initramfs: $OUT/initramfs.cpio.gz ($(du -h "$OUT/initramfs.cpio.gz" | cut -f1))"