qemu: RS485 bridge to sim, portal E2E scenario, CI wiring

Phase 3 of the device sim, all verified on QEMU 10.0.11:

- qemu/rs485-bridge/: std-only crate bridging a QEMU serial chardev (unix
  socket) to warden_sim::ModbusSlave — gap-based RTU framing (CRC failures
  degrade to real-slave silence), line-protocol control socket for register
  seeding and fault injection (drop/exception/clear), bounds-checked so a
  scenario typo answers err instead of panicking the bus. 7 unit tests,
  bench in the sim_bench pattern. Verified end-to-end: guest master frame
  on /dev/ttyS4 (pci-serial) answered from the sim slave, CRC-correct.
- virt machine gains highmem=off: the 32-bit non-LPAE kernel cannot reach
  virt's default 40-bit PCIe ECAM (pci-host-generic EOVERFLOW); with it the
  full PCI set probes (16550A ttyS0, i6300esb).
- Watchdog scenario verified: guest arms /dev/watchdog, no petting, i6300esb
  resets the VM ~30s later (first environment where this arm is testable).
- qemu/tests/portal-scenario.sh: the real static-musl warden-flared inside
  the VM against flare-edge's mock portal on the host — authenticated
  check-in, firmware desired-state pull, and download of a real signed
  tier-1 .wfw offer, asserted from the portal log. Found and filed
  flare-edge#106 (fatal SIGBUS in the HPMCU boot-loaded probe on
  non-RV1106 memory maps); runs against a flared built from the
  qemu-vm-support fix branch.
- stage-2 init: WARDEN_FLARE_INSECURE=1 + WARDEN_HPMCU=0 (documented VM
  deviations), firmware-version stamp, newline-terminated state seeds.
- CI: rs485-bridge joins the test loop and bench job; new qemu-tools job
  (shellcheck + initramfs + disk image on hosted runners); kernel-build
  gains a fail-closed qemu boot-smoke step. All qemu scripts shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/run.sh

@@ -25,6 +25,7 @@
 set -euo pipefail
 
 QEMU_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=qemu/blkdevparts.conf disable=SC1091
 . "$QEMU_DIR/blkdevparts.conf"
 OUT="${OUT:-$QEMU_DIR/out}"
 
@@ -54,10 +55,10 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-[ -n "$KERNEL" ] && [ -f "$KERNEL" ] || {
+if [ -z "$KERNEL" ] || [ ! -f "$KERNEL" ]; then
   echo "FATAL: --kernel <zImage> required and must exist (got '${KERNEL:-}')" >&2
   exit 1
-}
+fi
 [ -f "$INITRD" ] || {
   echo "FATAL: initramfs not found at $INITRD — run qemu/mkinitramfs.sh" >&2
   exit 1
@@ -76,30 +77,30 @@ fi
 # 0xff4c0000, which does not exist on -M virt.
 APPEND="console=ttyAMA0 rdinit=/init"
 ARGS=(
-  -M virt -cpu cortex-a7 -smp 1 -m 256M
+  -M "virt,highmem=off" -cpu cortex-a7 -smp 1 -m 256M
   -kernel "$KERNEL" -initrd "$INITRD"
   -netdev "user,id=n0,hostfwd=tcp:127.0.0.1:${SSH_PORT}-:22,hostfwd=tcp:127.0.0.1:${HTTP_PORT}-:80,hostfwd=tcp:127.0.0.1:${API_PORT}-:28443"
-  -device virtio-net-device,netdev=n0
+  -device "virtio-net-device,netdev=n0"
   -no-reboot
 )
 
 if [ -n "$DISK" ] && [ "$NO_DISK" -eq 0 ]; then
   APPEND="$APPEND blkdevparts=$WARDEN_BLKDEVPARTS warden.slot=$SLOT"
   ARGS+=( -drive "if=none,file=$DISK,format=raw,id=vd0"
-          -device virtio-blk-device,drive=vd0 )
+          -device "virtio-blk-device,drive=vd0" )
 fi
 [ "$SHELL_FLAG" -eq 1 ] && APPEND="$APPEND warden.shell"
 [ -n "$RTC" ] && ARGS+=( -rtc "base=$RTC" )
 [ "$WATCHDOG" -eq 1 ] && ARGS+=( -device i6300esb -action watchdog=reset )
 [ -n "$RS485" ] && ARGS+=( -chardev "socket,id=rs485,path=$RS485,server=on,wait=off"
-                           -device pci-serial,chardev=rs485 )
+                           -device "pci-serial,chardev=rs485" )
 [ -n "$QMP" ] && ARGS+=( -qmp "unix:$QMP,server=on,wait=off" )
 
 case "$DISPLAY_MODE" in
   off)      ARGS+=( -nographic ) ;;
-  on)       ARGS+=( -device virtio-gpu-device,xres=720,yres=720
+  on)       ARGS+=( -device "virtio-gpu-device,xres=720,yres=720"
                     -device virtio-tablet-device -serial mon:stdio ) ;;
-  headless) ARGS+=( -device virtio-gpu-device,xres=720,yres=720
+  headless) ARGS+=( -device "virtio-gpu-device,xres=720,yres=720"
                     -device virtio-tablet-device -display none -serial mon:stdio ) ;;
   *) echo "FATAL: --display must be off|on|headless" >&2; exit 1 ;;
 esac