qemu: RS485 bridge to sim, portal E2E scenario, CI wiring

Phase 3 of the device sim, all verified on QEMU 10.0.11:

- qemu/rs485-bridge/: std-only crate bridging a QEMU serial chardev (unix
  socket) to warden_sim::ModbusSlave — gap-based RTU framing (CRC failures
  degrade to real-slave silence), line-protocol control socket for register
  seeding and fault injection (drop/exception/clear), bounds-checked so a
  scenario typo answers err instead of panicking the bus. 7 unit tests,
  bench in the sim_bench pattern. Verified end-to-end: guest master frame
  on /dev/ttyS4 (pci-serial) answered from the sim slave, CRC-correct.
- virt machine gains highmem=off: the 32-bit non-LPAE kernel cannot reach
  virt's default 40-bit PCIe ECAM (pci-host-generic EOVERFLOW); with it the
  full PCI set probes (16550A ttyS0, i6300esb).
- Watchdog scenario verified: guest arms /dev/watchdog, no petting, i6300esb
  resets the VM ~30s later (first environment where this arm is testable).
- qemu/tests/portal-scenario.sh: the real static-musl warden-flared inside
  the VM against flare-edge's mock portal on the host — authenticated
  check-in, firmware desired-state pull, and download of a real signed
  tier-1 .wfw offer, asserted from the portal log. Found and filed
  flare-edge#106 (fatal SIGBUS in the HPMCU boot-loaded probe on
  non-RV1106 memory maps); runs against a flared built from the
  qemu-vm-support fix branch.
- stage-2 init: WARDEN_FLARE_INSECURE=1 + WARDEN_HPMCU=0 (documented VM
  deviations), firmware-version stamp, newline-terminated state seeds.
- CI: rs485-bridge joins the test loop and bench job; new qemu-tools job
  (shellcheck + initramfs + disk image on hosted runners); kernel-build
  gains a fail-closed qemu boot-smoke step. All qemu scripts shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/tests/boot-smoke.sh

@@ -10,10 +10,10 @@ HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"     # qemu/tests/
 QDIR="$(cd "$HERE/.." && pwd)"                           # qemu/
 
 ZIMAGE="${1:-}"
-[ -n "$ZIMAGE" ] && [ -f "$ZIMAGE" ] || {
+if [ -z "$ZIMAGE" ] || [ ! -f "$ZIMAGE" ]; then
   echo "FATAL: usage: $0 <zImage> [initramfs] — zImage missing or not a file: '${ZIMAGE:-}'" >&2
   exit 1
-}
+fi
 INITRD="${2:-$QDIR/out/initramfs.cpio.gz}"
 [ -f "$INITRD" ] || {
   echo "FATAL: initramfs not found at $INITRD — run qemu/mkinitramfs.sh first" >&2
@@ -30,7 +30,7 @@ trap 'rm -f "$LOG"' EXIT
 # NOTE: never pass `earlyprintk` — the config's DEBUG_UART_PHYS is the RV1106's
 # 0xff4c0000, which does not exist on -M virt.
 timeout 180 qemu-system-arm \
-  -M virt -cpu cortex-a7 -smp 1 -m 256M \
+  -M virt,highmem=off -cpu cortex-a7 -smp 1 -m 256M \
   -kernel "$ZIMAGE" -initrd "$INITRD" \
   -append "console=ttyAMA0 rdinit=/init" \
   -nographic -no-reboot </dev/null | tee "$LOG" || {