qemu: one image and initramfs per ui-drive run

mkinitramfs.sh, mkimage.sh and run.sh all read $OUT, and ui-drive.sh left
it at the shared default, so two concurrent runs built and booted the same
qemu/out/disk.img and wrote their userdata into it: a VM seeded with
role=1 read back client because the unseeded run next to it had rebuilt
the image (#20). Each run now builds and boots its own image under
$TMPDIR (real disk; /tmp is a tmpfs on the dev box and the run refuses to
start with under 1 GB free there), keeps the pinned busybox shared and
read-only through BUSYBOX, and removes the image on exit.

Verified: a seeded router-mode flow, the unseeded client-mode flow and a
third flow booted at once, 25/25, 25/25 and 10/10, each reading its own
role.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

qemu/tests/ui-drive.sh

@@ -73,6 +73,21 @@ command -v qemu-system-arm >/dev/null || {
 mkdir -p "$OUTDIR"
 # Short-named scratch: AF_UNIX socket paths are capped at ~108 chars.
 WORK="$(mktemp -d /tmp/wqd.XXXXXX)"
+# Every run gets its own image and initramfs: mkinitramfs.sh, mkimage.sh and
+# run.sh all read $OUT, and with the shared default (qemu/out) two concurrent
+# runs built and booted the SAME disk.img, so a seeded VM could read back
+# another run's state (SDK #20). The image is sparse but is written by the
+# guest, and /tmp is a tmpfs on the dev box, so this lives under $TMPDIR on
+# real disk; the pinned busybox stays shared and read-only through BUSYBOX.
+avail_kb="$(df --output=avail -k "${TMPDIR:-/tmp}" | tail -1 | tr -d ' ')"
+if [ "${avail_kb:-0}" -lt 1048576 ]; then
+  echo "FATAL: ${TMPDIR:-/tmp} has under 1 GB free; point TMPDIR at real disk (see flows README)" >&2
+  exit 1
+fi
+mkdir -p "$QDIR/out"
+RUN_OUT="$(mktemp -d "${TMPDIR:-/tmp}/wqd-out.XXXXXX")"
+export OUT="$RUN_OUT"
+export BUSYBOX="${BUSYBOX:-$QDIR/out/busybox-armv7l}"
 QEMU_PID=""
 cleanup() {
   if [ -n "$QEMU_PID" ]; then
@@ -81,7 +96,7 @@ cleanup() {
     kill "$QEMU_PID" 2>/dev/null || true
   fi
   cp "$WORK/console.log" "$OUTDIR/console.log" 2>/dev/null || true
-  rm -rf "$WORK"
+  rm -rf "$WORK" "$RUN_OUT"
 }
 trap cleanup EXIT