qemu: device-sim bringup — boot smoke, A/B disk harness, virt kernel variant

The third simulator (deliberately not named "sim"): a QEMU -M virt VM that
boots the real 6.18.46 kernel and enters at -kernel zImage — everything below
(BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM
and is explicitly out of scope.

- qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/
- qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical
  12-partition blkdevparts A/B layout (vda == mmcblk0 mapping)
- qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents,
  whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem
  mounts, slirp networking, payload daemon start)
- qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display
- qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in
  build/build-kernel.sh (canonical RV1106 build untouched when unset):
  adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input
- qemu/tests/boot-smoke.sh: sentinel-asserting boot test

Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the
feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full
stack boots both slots; 12 by-name symlinks; userdata persists across
reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/rootfs/etc/rc

@@ -0,0 +1,54 @@
+#!/bin/busybox sh
+# Stage-1 rc: sourced by /init (still PID 1, initramfs root) when a virtio
+# disk is present. Emulates U-Boot's slot choice — parse warden.slot= from the
+# cmdline, mount that rootfs, switch_root into it. This is an EMULATION of the
+# A/B selection outcome, not the BCB/bootcount mechanism itself.
+
+# /dev/block/by-name/<PARTNAME> symlinks: the contract flare-edge slotctl.rs
+# relies on. blkdevparts= gives every vda partition a PARTNAME in sysfs.
+mkdir -p /dev/block/by-name
+for uev in /sys/class/block/vda*/uevent; do
+    [ -f "$uev" ] || continue
+    partname=""
+    devname=""
+    while IFS='=' read -r k v; do
+        case "$k" in
+            PARTNAME) partname="$v" ;;
+            DEVNAME)  devname="$v" ;;
+        esac
+    done < "$uev"
+    [ -n "$partname" ] && [ -n "$devname" ] \
+        && ln -sf "/dev/$devname" "/dev/block/by-name/$partname"
+done
+
+# Slot select: whole-token parse of warden.slot= (never a substring match).
+slot="_a"
+for tok in $(cat /proc/cmdline); do
+    case "$tok" in
+        warden.slot=*) slot="${tok#warden.slot=}" ;;
+    esac
+done
+case "$slot" in
+    _a|_b) ;;
+    *) echo "rc: bad warden.slot='$slot', falling back to _a"; slot="_a" ;;
+esac
+
+root="/dev/block/by-name/rootfs${slot}"
+if [ ! -e "$root" ]; then
+    echo "rc: $root missing — staying in initramfs"
+    return 0
+fi
+
+mkdir -p /mnt
+if ! mount -t ext4 "$root" /mnt; then
+    echo "rc: mount of $root failed — staying in initramfs"
+    return 0
+fi
+if [ ! -x /mnt/sbin/init ]; then
+    echo "rc: $root has no /sbin/init — staying in initramfs"
+    umount /mnt
+    return 0
+fi
+
+echo "rc: switching root to rootfs${slot} ($root)"
+exec switch_root /mnt /sbin/init