fix: kernel AppArmor 2-pass olddefconfig and QEMU test direct kernel boot

The stock TinyCore kernel config has "# CONFIG_SECURITY is not set" which
caused make olddefconfig to silently revert all security configs in a single
pass. Fix by applying security configs (AppArmor, Audit, LSM) after the
first olddefconfig resolves base dependencies, then running a second pass.
Added mandatory verification that exits on missing critical configs.

All QEMU test scripts converted from broken -cdrom + -append pattern to
direct kernel boot (-kernel + -initrd) via shared test/lib/qemu-helpers.sh
helper library. The -append flag only works with -kernel, not -cdrom.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/integration/test-network-policy.sh

@@ -6,35 +6,50 @@
 set -euo pipefail
 
 ISO="${1:?Usage: $0 <path-to-iso>}"
-TIMEOUT_K8S=300
-TIMEOUT_POD=120
+TIMEOUT_K8S=${TIMEOUT_K8S:-300}
+TIMEOUT_POD=${TIMEOUT_POD:-120}
 API_PORT=6443
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+. "$SCRIPT_DIR/../lib/qemu-helpers.sh"
+
 DATA_DISK=$(mktemp /tmp/kubesolo-data-XXXXXX.img)
 dd if=/dev/zero of="$DATA_DISK" bs=1M count=1024 2>/dev/null
 mkfs.ext4 -q -L KSOLODATA "$DATA_DISK" 2>/dev/null
 
 SERIAL_LOG=$(mktemp /tmp/kubesolo-netpol-XXXXXX.log)
 
+QEMU_PID=""
+EXTRACT_DIR=""
+KUBECTL="kubectl --server=https://localhost:${API_PORT} --insecure-skip-tls-verify"
+
 cleanup() {
     $KUBECTL delete namespace netpol-test 2>/dev/null || true
-    kill "$QEMU_PID" 2>/dev/null || true
+    [ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null || true
     rm -f "$DATA_DISK" "$SERIAL_LOG"
+    [ -n "$EXTRACT_DIR" ] && rm -rf "$EXTRACT_DIR"
 }
 trap cleanup EXIT
 
-KUBECTL="kubectl --server=https://localhost:${API_PORT} --insecure-skip-tls-verify"
-
 echo "==> Network policy test: $ISO"
 
+# Extract kernel from ISO
+EXTRACT_DIR="$(mktemp -d /tmp/kubesolo-extract-XXXXXX)"
+extract_kernel_from_iso "$ISO" "$EXTRACT_DIR"
+
+KVM_FLAG=$(detect_kvm)
+
 # Launch QEMU
+# shellcheck disable=SC2086
 qemu-system-x86_64 \
     -m 2048 -smp 2 \
     -nographic \
-    -cdrom "$ISO" \
-    -boot d \
+    $KVM_FLAG \
+    -kernel "$VMLINUZ" \
+    -initrd "$INITRAMFS" \
     -drive "file=$DATA_DISK,format=raw,if=virtio" \
-    -net nic,model=virtio \
+    -net "nic,model=virtio" \
     -net "user,hostfwd=tcp::${API_PORT}-:6443" \
     -serial "file:$SERIAL_LOG" \
     -append "console=ttyS0,115200n8 kubesolo.data=/dev/vda" \
@@ -81,6 +96,7 @@ YAML
 
 # Wait for pod
 ELAPSED=0
+STATUS=""
 while [ "$ELAPSED" -lt "$TIMEOUT_POD" ]; do
     STATUS=$($KUBECTL get pod -n netpol-test web -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
     [ "$STATUS" = "Running" ] && break