review: iteration-3 fixes (convergence pass)

- ci-cd.md phrasing made time-invariant (true before and after the
  visibility flip; the prior wording asserted a state not yet real).
- ui-shot: liveness check before the tap QMP call too — the commit-message
  claim of "before every QMP call" is now actually true.
- busybox fetcher checks its pin before downloading, mirroring the
  kernel-tarball fetcher's ordering.
- Fragment disable-arm: absence of a deps-gated symbol is a valid disable
  outcome; only "still set" is fatal (the iteration-2 symmetrization
  overcorrected). Negative-tested both directions under set -e.

Iteration 3 produced four findings, none blocking, all applied — the
recursive review is converged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K

qemu/lib.sh

@@ -16,14 +16,16 @@ qemu_get_busybox() {
   local out="${OUT:-$QEMU_DIR/out}"
   mkdir -p "$out"
   BB="${BUSYBOX:-$out/busybox-armv7l}"
-  if [ ! -f "$BB" ]; then
-    qemu_log "downloading $BB_URL"
-    curl --retry 3 --retry-delay 5 --retry-connrefused -fSL "$BB_URL" -o "$BB"
-  fi
+  # Pin first: a missing pin refuses BEFORE downloading, same ordering as
+  # build/fetch-kernel-tarball.sh.
   [ -f "$sha_file" ] || {
     echo "FATAL: no pinned sha256 for busybox (expected $sha_file) — refusing to build from an unverified binary" >&2
     exit 1
   }
+  if [ ! -f "$BB" ]; then
+    qemu_log "downloading $BB_URL"
+    curl --retry 3 --retry-delay 5 --retry-connrefused -fSL "$BB_URL" -o "$BB"
+  fi
   local want got
   want="$(cat "$sha_file")"
   got="$(sha256sum "$BB" | awk '{print $1}')"