qemu: full OTA apply scenario — write rootfs_b, flip AvbABData, boot it

Closes the loop every prior harness stopped short of, entirely
off-hardware: the real flared (WARDEN_HARD_RESET-gated build) pulls a
real signed tier-1 .wfw whose payload is a BOOTABLE rootfs stamped
0.0.2, verifies it, writes /dev/block/by-name/rootfs_b inside disk.img,
and flips the AvbABData (slot B: priority 15, 3 tries, unsuccessful —
the exact pre-first-boot arming state, round-tripped through a portal
check-in). The harness then boots slot _b and asserts the applied
version + marker are what runs. OTA-APPLY-PASS verified end to end.

- mkimage: the misc partition now carries REAL provisioned AvbABData
  (bytes mirror flare-edge's provisioning defaults) — slotctl fail-closes
  on bad AB magic before writing, which a zeroed misc tripped.
- run.sh --allow-apply / cmdline warden.fwapply: per-boot opt-in that
  makes stage-2 init export WARDEN_FW_ALLOW_APPLY=1; never the default.
- stage-2 init also exports WARDEN_HARD_RESET=0 (the CRU poke is fatal on
  virt, same class as the HPMCU probe); the harness performs the reboot.
- ADR-0006 boundary documented in the scenario and README: BCB slot
  CHOICE and the physical reset remain emulated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/rootfs/sbin/init

@@ -70,6 +70,16 @@ export WARDEN_FLARE_INSECURE=1
 # here, and flared's /dev/mem poke dies with an external abort (SIGBUS). The
 # SCR1 supervisor state machine is modeled in sim/src/hpmcu.rs instead.
 export WARDEN_HPMCU=0
+# Same class: the CRU reset ladder's /dev/mem poke is fatal on virt. A
+# post-apply "reboot" surfaces as a clean flared error; the scenario harness
+# performs the actual reboot into the applied slot.
+export WARDEN_HARD_RESET=0
+# OTA apply is opt-in per boot (run.sh --allow-apply): writing rootfs_b is
+# safe inside disk.img but must never be the default posture.
+if grep -qw warden.fwapply /proc/cmdline; then
+    export WARDEN_FW_ALLOW_APPLY=1
+    echo "init: OTA APPLY ENABLED (warden.fwapply)"
+fi
 for d in /usr/bin/warden-flared /usr/bin/warden-modbus; do
     if [ -x "$d" ]; then
         name="$(basename "$d")"