qemu: device-sim bringup — boot smoke, A/B disk harness, virt kernel variant

The third simulator (deliberately not named "sim"): a QEMU -M virt VM that
boots the real 6.18.46 kernel and enters at -kernel zImage — everything below
(BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM
and is explicitly out of scope.

- qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/
- qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical
  12-partition blkdevparts A/B layout (vda == mmcblk0 mapping)
- qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents,
  whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem
  mounts, slirp networking, payload daemon start)
- qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display
- qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in
  build/build-kernel.sh (canonical RV1106 build untouched when unset):
  adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input
- qemu/tests/boot-smoke.sh: sentinel-asserting boot test

Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the
feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full
stack boots both slots; 12 by-name symlinks; userdata persists across
reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/rootfs/init

@@ -0,0 +1,32 @@
+#!/bin/busybox sh
+# WardenOS QEMU device sim: initramfs /init (PID 1).
+#
+# Phase-1 duty: prove the kernel booted on -M virt — print the sentinel the
+# smoke test greps for, then power off (PSCI SYSTEM_OFF, so qemu exits).
+# `warden.shell` on the kernel cmdline drops to an interactive shell instead.
+
+/bin/busybox mount -t devtmpfs devtmpfs /dev 2>/dev/null
+
+# The cpio archive carries no device nodes (it is built unprivileged, no
+# mknod); reopen stdio on the real console now that devtmpfs is mounted.
+exec </dev/console >/dev/console 2>&1
+
+/bin/busybox --install -s /bin
+mount -t proc proc /proc
+mount -t sysfs sysfs /sys
+
+echo "WARDEN-QEMU-BOOT-OK"
+
+# With a virtio disk attached, hand over to the stage-1 rc (by-name symlinks,
+# slot select, switch_root). It only returns on failure — then fall through to
+# the diskless shell/poweroff behavior below.
+if [ -b /dev/vda ]; then
+    . /etc/rc
+fi
+
+if grep -qw warden.shell /proc/cmdline; then
+    echo "warden.shell: interactive shell (exit to power off)"
+    setsid cttyhack sh
+fi
+
+poweroff -f