test: QEMU + swtpm Phase 1 integration harness

[Bugs5382]

Implement the //go:build integration Phase 1 end-to-end harness and task test:integration: generate a bootstrap admin keypair, render machine.yaml, boot the UKI in QEMU + swtpm + OVMF, drive cryptosctl ceremony start / identity show / identity validate / status, assert the event order and that the Root cert passes zlint with zero errors/warnings, all in < 60s.

Deferred to a Linux host with QEMU + swtpm — requires qemu-system-x86_64, swtpm, OVMF, and a built UKI (#33), none available on the darwin dev host. This is the Phase 1 acceptance gate.

[Bugs5382]

Networking note for the first run on the runner: the harness renders the machine config with network.address: 10.0.0.10/24 (gw 10.0.0.1), but QEMU's default user-mode networking NATs 10.0.2.0/24 (DHCP guest 10.0.2.15, gateway 10.0.2.2). A guest that sets a static 10.0.0.10 won't be reachable through the hostfwd, so the ceremony connection over 127.0.0.1:4443 will fail.

Two ways to reconcile when validating:

1. Render the machine config with QEMU user-net addressing (10.0.2.15/24, gw 10.0.2.2) and forward hostfwd=tcp:127.0.0.1:4443-10.0.2.15:443; the node binds that address.
2. Or use a different QEMU netdev (e.g. a tap/bridge) matching 10.0.0.10/24.

Left unfixed deliberately — it's a guess until it's actually booted; settle it on the runner.

[Bugs5382]

Arch note: the harness hardcodes qemu-system-x86_64 and cryptos-amd64.uki.unsigned, but the self-hosted runner is a Raspberry Pi (arm64). To run there it needs arch parameterization — build the arm64 UKI and boot with qemu-system-aarch64 (which also needs an -machine virt -cpu cortex-a72 style invocation and the AArch64 OVMF, not the x86 q35/OVMF args). Easiest first pass: validate on an x86-64 Linux box as-is, then parameterize arch for the Pi.

[Bugs5382]

Reopening: the harness code is merged (#56) but has never run, and the two findings above (QEMU user-net subnet, arm64 vs amd64) mean it won't pass as-is. This is the Phase 1 acceptance gate — keeping it open until it actually runs green on a Linux host.