qemu: RS485 bridge to sim, portal E2E scenario, CI wiring

Phase 3 of the device sim, all verified on QEMU 10.0.11:

- qemu/rs485-bridge/: std-only crate bridging a QEMU serial chardev (unix
  socket) to warden_sim::ModbusSlave — gap-based RTU framing (CRC failures
  degrade to real-slave silence), line-protocol control socket for register
  seeding and fault injection (drop/exception/clear), bounds-checked so a
  scenario typo answers err instead of panicking the bus. 7 unit tests,
  bench in the sim_bench pattern. Verified end-to-end: guest master frame
  on /dev/ttyS4 (pci-serial) answered from the sim slave, CRC-correct.
- virt machine gains highmem=off: the 32-bit non-LPAE kernel cannot reach
  virt's default 40-bit PCIe ECAM (pci-host-generic EOVERFLOW); with it the
  full PCI set probes (16550A ttyS0, i6300esb).
- Watchdog scenario verified: guest arms /dev/watchdog, no petting, i6300esb
  resets the VM ~30s later (first environment where this arm is testable).
- qemu/tests/portal-scenario.sh: the real static-musl warden-flared inside
  the VM against flare-edge's mock portal on the host — authenticated
  check-in, firmware desired-state pull, and download of a real signed
  tier-1 .wfw offer, asserted from the portal log. Found and filed
  flare-edge#106 (fatal SIGBUS in the HPMCU boot-loaded probe on
  non-RV1106 memory maps); runs against a flared built from the
  qemu-vm-support fix branch.
- stage-2 init: WARDEN_FLARE_INSECURE=1 + WARDEN_HPMCU=0 (documented VM
  deviations), firmware-version stamp, newline-terminated state seeds.
- CI: rs485-bridge joins the test loop and bench job; new qemu-tools job
  (shellcheck + initramfs + disk image on hosted runners); kernel-build
  gains a fail-closed qemu boot-smoke step. All qemu scripts shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/rootfs/sbin/init

@@ -62,6 +62,13 @@ hostname warden-qemu
 echo "WARDEN-QEMU-ROOTFS-OK slot=${slot}"
 
 # Payload daemons (dropped into /usr/bin by qemu/mkimage.sh from qemu/payload/).
+# WARDEN_FLARE_INSECURE=1: the VM's portal is the desk mock over plain HTTP.
+# This is a dev instrument — a production device build never sets it.
+export WARDEN_FLARE_INSECURE=1
+# No HPMCU on -M virt: the mailbox SRAM (0xff6fff00) is unmapped bus space
+# here, and flared's /dev/mem poke dies with an external abort (SIGBUS). The
+# SCR1 supervisor state machine is modeled in sim/src/hpmcu.rs instead.
+export WARDEN_HPMCU=0
 for d in /usr/bin/warden-flared /usr/bin/warden-modbus; do
     if [ -x "$d" ]; then
         name="$(basename "$d")"