qemu: RS485 bridge to sim, portal E2E scenario, CI wiring

Phase 3 of the device sim, all verified on QEMU 10.0.11:

- qemu/rs485-bridge/: std-only crate bridging a QEMU serial chardev (unix
  socket) to warden_sim::ModbusSlave — gap-based RTU framing (CRC failures
  degrade to real-slave silence), line-protocol control socket for register
  seeding and fault injection (drop/exception/clear), bounds-checked so a
  scenario typo answers err instead of panicking the bus. 7 unit tests,
  bench in the sim_bench pattern. Verified end-to-end: guest master frame
  on /dev/ttyS4 (pci-serial) answered from the sim slave, CRC-correct.
- virt machine gains highmem=off: the 32-bit non-LPAE kernel cannot reach
  virt's default 40-bit PCIe ECAM (pci-host-generic EOVERFLOW); with it the
  full PCI set probes (16550A ttyS0, i6300esb).
- Watchdog scenario verified: guest arms /dev/watchdog, no petting, i6300esb
  resets the VM ~30s later (first environment where this arm is testable).
- qemu/tests/portal-scenario.sh: the real static-musl warden-flared inside
  the VM against flare-edge's mock portal on the host — authenticated
  check-in, firmware desired-state pull, and download of a real signed
  tier-1 .wfw offer, asserted from the portal log. Found and filed
  flare-edge#106 (fatal SIGBUS in the HPMCU boot-loaded probe on
  non-RV1106 memory maps); runs against a flared built from the
  qemu-vm-support fix branch.
- stage-2 init: WARDEN_FLARE_INSECURE=1 + WARDEN_HPMCU=0 (documented VM
  deviations), firmware-version stamp, newline-terminated state seeds.
- CI: rs485-bridge joins the test loop and bench job; new qemu-tools job
  (shellcheck + initramfs + disk image on hosted runners); kernel-build
  gains a fail-closed qemu boot-smoke step. All qemu scripts shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
         run: |
           set -o pipefail
           : > /tmp/test.log
-          for d in sim tools/config-lint; do
+          for d in sim tools/config-lint qemu/rs485-bridge; do
             echo "== cargo test in $d ==" | tee -a /tmp/test.log
             ( cd "$d" && cargo test --locked ) 2>&1 | tee -a /tmp/test.log
           done
@@ -85,6 +85,34 @@ jobs:
           cargo bench --locked --bench sim_bench 1> bench.txt 2> bench.json
           echo "== timings =="; cat bench.txt
           echo "== trend json =="; grep '"bench"' bench.json
+      - name: run rs485-bridge benchmarks
+        working-directory: qemu/rs485-bridge
+        run: |
+          cargo bench --locked --bench bridge_bench 1> bench.txt 2> bench.json
+          echo "== timings =="; cat bench.txt
+          echo "== trend json =="; grep '"bench"' bench.json
+
+  qemu-tools:
+    # The qemu/ device-sim build tooling must stay healthy on a plain hosted
+    # runner: shellcheck the scripts, build the initramfs (pinned busybox,
+    # fail-closed sha), and build the A/B disk image (unprivileged mkfs -d).
+    # Booting needs a zImage and therefore lives in kernel-build's smoke step.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: shellcheck qemu scripts
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck
+          shellcheck -x qemu/*.sh qemu/tests/*.sh
+      - name: cache pinned busybox
+        uses: actions/cache@v4
+        with:
+          path: qemu/out/busybox-armv7l
+          key: busybox-armv7l-${{ hashFiles('qemu/busybox.sha256') }}
+      - name: build initramfs
+        run: bash qemu/mkinitramfs.sh
+      - name: build A/B disk image
+        run: bash qemu/mkimage.sh
 
   patches-apply:
     # The RV1106 series must apply cleanly onto pristine linux-6.18.46.
@@ -167,6 +195,16 @@ jobs:
           # the ephemeral Luckfox SDK checkout path.
           CROSS_COMPILE: arm-linux-gnueabihf-
         run: bash build/build-kernel.sh
+      # Boot smoke under QEMU: the zImage this job just built must reach the
+      # initramfs sentinel on -M virt (verified 2026-08-29: the canonical
+      # config boots virt as-is). FAIL-CLOSED on a missing qemu-system-arm —
+      # provisioning the runner (one-time `apt-get install qemu-system-arm`
+      # on bfe-mpc-0640) is part of docs/ci-cd.md, never a silent skip.
+      - name: boot smoke (qemu-system-arm -M virt)
+        run: |
+          bash qemu/mkinitramfs.sh
+          bash qemu/tests/boot-smoke.sh \
+            "$RUNNER_TEMP/kbuild-out/linux-6.18.46/arch/arm/boot/zImage"
       # Best-effort: the build IS the gate. Uploading the zImage/dtb to GitHub
       # artifact storage can fail on an account-wide storage-quota hit (recalculated
       # every 6-12h) that has nothing to do with this build — don't red-X a good