qemu: device-sim bringup — boot smoke, A/B disk harness, virt kernel variant

The third simulator (deliberately not named "sim"): a QEMU -M virt VM that
boots the real 6.18.46 kernel and enters at -kernel zImage — everything below
(BootROM/idblock/U-Boot/real BCB A/B selection) is closed blobs + mask ROM
and is explicitly out of scope.

- qemu/mkinitramfs.sh: pinned static busybox (sha256 fail-closed) + rootfs/
- qemu/mkimage.sh: unprivileged sparse disk image with the device's canonical
  12-partition blkdevparts A/B layout (vda == mmcblk0 mapping)
- qemu/rootfs/: stage-1 init (by-name symlinks from PARTNAME uevents,
  whole-token warden.slot= parse, switch_root) + stage-2 init (userdata/oem
  mounts, slirp networking, payload daemon start)
- qemu/run.sh: runner with --slot/--rtc/--watchdog/--rs485/--qmp/--display
- qemu/configs/virt.fragment + WARDEN_KCONFIG_FRAGMENT hook in
  build/build-kernel.sh (canonical RV1106 build untouched when unset):
  adds PCI, pci-serial, i6300esb watchdog, WireGuard, virtio-gpu/input
- qemu/tests/boot-smoke.sh: sentinel-asserting boot test

Verified on QEMU 10.0.11: canonical zImage boots -M virt unmodified (the
feared DEBUG_UNCOMPRESS decompressor hang does not exist in 6.18); full
stack boots both slots; 12 by-name symlinks; userdata persists across
reboot; -rtc base=2021-01-01 reproduces the no-RTC wrong-clock class.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/tests/boot-smoke.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Boot the warden kernel under qemu-system-arm -M virt and assert the initramfs
+# sentinel appears on the console. FAILS CLOSED: a missing zImage, initramfs,
+# or qemu binary is an error, never a skip.
+#
+# Usage: boot-smoke.sh <zImage> [initramfs.cpio.gz]
+set -euo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"     # qemu/tests/
+QDIR="$(cd "$HERE/.." && pwd)"                           # qemu/
+
+ZIMAGE="${1:-}"
+[ -n "$ZIMAGE" ] && [ -f "$ZIMAGE" ] || {
+  echo "FATAL: usage: $0 <zImage> [initramfs] — zImage missing or not a file: '${ZIMAGE:-}'" >&2
+  exit 1
+}
+INITRD="${2:-$QDIR/out/initramfs.cpio.gz}"
+[ -f "$INITRD" ] || {
+  echo "FATAL: initramfs not found at $INITRD — run qemu/mkinitramfs.sh first" >&2
+  exit 1
+}
+command -v qemu-system-arm >/dev/null || {
+  echo "FATAL: qemu-system-arm not on PATH (apt-get install qemu-system-arm) — see qemu/README.md" >&2
+  exit 1
+}
+
+LOG="$(mktemp "${TMPDIR:-/tmp}/warden-qemu-smoke.XXXXXX")"
+trap 'rm -f "$LOG"' EXIT
+
+# NOTE: never pass `earlyprintk` — the config's DEBUG_UART_PHYS is the RV1106's
+# 0xff4c0000, which does not exist on -M virt.
+timeout 180 qemu-system-arm \
+  -M virt -cpu cortex-a7 -smp 1 -m 256M \
+  -kernel "$ZIMAGE" -initrd "$INITRD" \
+  -append "console=ttyAMA0 rdinit=/init" \
+  -nographic -no-reboot </dev/null | tee "$LOG" || {
+    echo "FATAL: qemu exited non-zero (or hung until the 180s timeout)" >&2
+    exit 1
+  }
+
+grep -q "WARDEN-QEMU-BOOT-OK" "$LOG" || {
+  echo "FATAL: boot sentinel WARDEN-QEMU-BOOT-OK not found in console log" >&2
+  exit 1
+}
+echo "boot smoke OK"