fix: kernel AppArmor 2-pass olddefconfig and QEMU test direct kernel boot

The stock TinyCore kernel config has "# CONFIG_SECURITY is not set" which
caused make olddefconfig to silently revert all security configs in a single
pass. Fix by applying security configs (AppArmor, Audit, LSM) after the
first olddefconfig resolves base dependencies, then running a second pass.
Added mandatory verification that exits on missing critical configs.

All QEMU test scripts converted from broken -cdrom + -append pattern to
direct kernel boot (-kernel + -initrd) via shared test/lib/qemu-helpers.sh
helper library. The -append flag only works with -kernel, not -cdrom.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/integration/test-security-hardening.sh

@@ -12,9 +12,13 @@
 set -euo pipefail
 
 ISO="${1:?Usage: $0 <path-to-iso>}"
-TIMEOUT_BOOT=180    # seconds to wait for boot
+TIMEOUT_BOOT=${TIMEOUT_BOOT:-180}    # seconds to wait for boot
 SERIAL_LOG=$(mktemp /tmp/kubesolo-security-test-XXXXXX.log)
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+. "$SCRIPT_DIR/../lib/qemu-helpers.sh"
+
 # Temp data disk
 DATA_DISK=$(mktemp /tmp/kubesolo-security-data-XXXXXX.img)
 dd if=/dev/zero of="$DATA_DISK" bs=1M count=1024 2>/dev/null
@@ -22,6 +26,7 @@ mkfs.ext4 -q -L KSOLODATA "$DATA_DISK" 2>/dev/null
 
 QEMU_PID=""
 EXTRACT_DIR=""
+
 cleanup() {
     [ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null || true
     rm -f "$DATA_DISK" "$SERIAL_LOG"
@@ -33,68 +38,12 @@ echo "==> Security Hardening Test: $ISO"
 echo "    Timeout: ${TIMEOUT_BOOT}s"
 echo "    Serial log: $SERIAL_LOG"
 
+# Extract kernel from ISO
+EXTRACT_DIR="$(mktemp -d /tmp/kubesolo-extract-XXXXXX)"
+extract_kernel_from_iso "$ISO" "$EXTRACT_DIR"
+
 # Detect KVM
-KVM_FLAG=""
-[ -w /dev/kvm ] 2>/dev/null && KVM_FLAG="-enable-kvm"
-
-# Extract kernel + initramfs from ISO (direct kernel boot required for -append)
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-ROOTFS_DIR="${ROOTFS_DIR:-$PROJECT_ROOT/build/rootfs-work}"
-EXTRACT_DIR=""
-
-VMLINUZ=""
-INITRAMFS=""
-
-if [ -f "$ROOTFS_DIR/vmlinuz" ] && [ -f "$ROOTFS_DIR/kubesolo-os.gz" ]; then
-    VMLINUZ="$ROOTFS_DIR/vmlinuz"
-    INITRAMFS="$ROOTFS_DIR/kubesolo-os.gz"
-    echo "    Using kernel/initramfs from build directory"
-else
-    EXTRACT_DIR="$(mktemp -d /tmp/kubesolo-extract-XXXXXX)"
-    EXTRACTED=0
-
-    echo "    Extracting kernel/initramfs from ISO..."
-
-    if [ $EXTRACTED -eq 0 ] && command -v bsdtar >/dev/null 2>&1; then
-        if bsdtar -xf "$ISO" -C "$EXTRACT_DIR" boot/vmlinuz boot/kubesolo-os.gz 2>/dev/null; then
-            EXTRACTED=1
-        fi
-    fi
-
-    if [ $EXTRACTED -eq 0 ] && command -v isoinfo >/dev/null 2>&1; then
-        mkdir -p "$EXTRACT_DIR/boot"
-        isoinfo -i "$ISO" -x "/BOOT/VMLINUZ;1" > "$EXTRACT_DIR/boot/vmlinuz" 2>/dev/null || true
-        isoinfo -i "$ISO" -x "/BOOT/KUBESOLO-OS.GZ;1" > "$EXTRACT_DIR/boot/kubesolo-os.gz" 2>/dev/null || true
-        if [ -s "$EXTRACT_DIR/boot/vmlinuz" ] && [ -s "$EXTRACT_DIR/boot/kubesolo-os.gz" ]; then
-            EXTRACTED=1
-        else
-            rm -f "$EXTRACT_DIR/boot/vmlinuz" "$EXTRACT_DIR/boot/kubesolo-os.gz"
-        fi
-    fi
-
-    if [ $EXTRACTED -eq 0 ] && [ "$(uname)" = "Linux" ]; then
-        ISO_MOUNT="$EXTRACT_DIR/mnt"
-        mkdir -p "$ISO_MOUNT"
-        if mount -o loop,ro "$ISO" "$ISO_MOUNT" 2>/dev/null; then
-            mkdir -p "$EXTRACT_DIR/boot"
-            cp "$ISO_MOUNT/boot/vmlinuz" "$EXTRACT_DIR/boot/" 2>/dev/null || true
-            cp "$ISO_MOUNT/boot/kubesolo-os.gz" "$EXTRACT_DIR/boot/" 2>/dev/null || true
-            umount "$ISO_MOUNT" 2>/dev/null || true
-            if [ -f "$EXTRACT_DIR/boot/vmlinuz" ] && [ -f "$EXTRACT_DIR/boot/kubesolo-os.gz" ]; then
-                EXTRACTED=1
-            fi
-        fi
-    fi
-
-    if [ $EXTRACTED -eq 0 ]; then
-        echo "ERROR: Failed to extract kernel/initramfs from ISO."
-        exit 1
-    fi
-
-    VMLINUZ="$EXTRACT_DIR/boot/vmlinuz"
-    INITRAMFS="$EXTRACT_DIR/boot/kubesolo-os.gz"
-fi
+KVM_FLAG=$(detect_kvm)
 
 # Launch QEMU in background with direct kernel boot
 # shellcheck disable=SC2086
@@ -171,7 +120,7 @@ fi
 
 echo ""
 echo "--- Test 2: AppArmor ---"
-if grep -q "AppArmor profiles loaded" "$SERIAL_LOG" 2>/dev/null; then
+if grep -q "AppArmor.*loaded.*profiles" "$SERIAL_LOG" 2>/dev/null; then
     check_pass "AppArmor profiles loaded"
 elif grep -q "AppArmor not available" "$SERIAL_LOG" 2>/dev/null; then
     check_skip "AppArmor not in kernel (expected before kernel rebuild)"