qemu: stage the panel's root credential files

The busybox skeleton had no /etc/shadow, so Settings/Security's root
password check (grep root: /etc/shadow, mkpasswd -m md5 with the same
salt) rejected the documented default password every time; the flow that
covers it could only record the rejection. The guest now carries
/etc/passwd, /etc/shadow (the overlay's root line, md5-crypt of the
default password with salt wardenrs, verified equal to openssl passwd -1)
and /etc/group.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3G6m9Aw5RyVY4ZowtKzEj

qemu/README.md

@@ -77,6 +77,11 @@ The VT cursor is kept off (`vt.global_cursor_default=0`): fbcon shares the
 virtio-gpu framebuffer with warden-ui and its blinking cursor would otherwise
 show up in screendumps at random (issue #18).
 
+The guest carries the panel's own `/etc/passwd`, `/etc/shadow` and
+`/etc/group` (root's md5-crypt of the documented default password), so a
+screen that verifies the root password against `/etc/shadow` behaves as it
+does on a panel instead of rejecting every attempt.
+
 ## Scenarios
 
 All take the virt-fragment `<zImage>`; `FLARE_EDGE=<checkout>` where noted.

qemu/rootfs/etc/group

@@ -0,0 +1,8 @@
+root:x:0:
+daemon:x:1:
+bin:x:2:
+sys:x:3:
+mail:x:8:
+www-data:x:33:
+operator:x:37:
+nogroup:x:65534:

qemu/rootfs/etc/passwd

@@ -0,0 +1,9 @@
+root:x:0:0:root:/root:/bin/sh
+daemon:x:1:1:daemon:/usr/sbin:/bin/false
+bin:x:2:2:bin:/bin:/bin/false
+sys:x:3:3:sys:/dev:/bin/false
+sync:x:4:100:sync:/bin:/bin/sync
+mail:x:8:8:mail:/var/spool/mail:/bin/false
+www-data:x:33:33:www-data:/var/www:/bin/false
+operator:x:37:37:Operator:/var:/bin/false
+nobody:x:65534:65534:nobody:/home:/bin/false

qemu/rootfs/etc/shadow

@@ -0,0 +1,9 @@
+root:$1$wardenrs$F.aYwbBz69WjSvwa3RNRF1:19664::::::
+daemon:*:::::::
+bin:*:::::::
+sys:*:::::::
+sync:*:::::::
+mail:*:::::::
+www-data:*:::::::
+operator:*:::::::
+nobody:*:::::::