fix: kernel AppArmor 2-pass olddefconfig and QEMU test direct kernel boot

The stock TinyCore kernel config has "# CONFIG_SECURITY is not set" which
caused make olddefconfig to silently revert all security configs in a single
pass. Fix by applying security configs (AppArmor, Audit, LSM) after the
first olddefconfig resolves base dependencies, then running a second pass.
Added mandatory verification that exits on missing critical configs.

All QEMU test scripts converted from broken -cdrom + -append pattern to
direct kernel boot (-kernel + -initrd) via shared test/lib/qemu-helpers.sh
helper library. The -append flag only works with -kernel, not -cdrom.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/lib/qemu-helpers.sh

@@ -0,0 +1,82 @@
+#!/bin/bash
+# qemu-helpers.sh — Shared functions for QEMU-based tests
+# Source this file from test scripts: . "$(dirname "$0")/../lib/qemu-helpers.sh"
+
+# extract_kernel_from_iso <iso-path> <extract-dir>
+# Sets VMLINUZ and INITRAMFS variables on success
+# Falls back to build/rootfs-work/ if available
+extract_kernel_from_iso() {
+    local iso="$1"
+    local extract_dir="$2"
+    local project_root="${PROJECT_ROOT:-$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)}"
+    local rootfs_dir="${ROOTFS_DIR:-$project_root/build/rootfs-work}"
+
+    VMLINUZ=""
+    INITRAMFS=""
+
+    # Prefer build artifacts (no extraction needed)
+    if [ -f "$rootfs_dir/vmlinuz" ] && [ -f "$rootfs_dir/kubesolo-os.gz" ]; then
+        VMLINUZ="$rootfs_dir/vmlinuz"
+        INITRAMFS="$rootfs_dir/kubesolo-os.gz"
+        echo "    Using kernel/initramfs from build directory"
+        return 0
+    fi
+
+    local extracted=0
+
+    echo "    Extracting kernel/initramfs from ISO..."
+
+    # Method 1: bsdtar (ships with macOS, libarchive-tools on Linux)
+    if [ $extracted -eq 0 ] && command -v bsdtar >/dev/null 2>&1; then
+        if bsdtar -xf "$iso" -C "$extract_dir" boot/vmlinuz boot/kubesolo-os.gz 2>/dev/null; then
+            echo "    Extracted via bsdtar"
+            extracted=1
+        fi
+    fi
+
+    # Method 2: isoinfo (genisoimage/cdrtools)
+    if [ $extracted -eq 0 ] && command -v isoinfo >/dev/null 2>&1; then
+        mkdir -p "$extract_dir/boot"
+        isoinfo -i "$iso" -x "/BOOT/VMLINUZ;1" > "$extract_dir/boot/vmlinuz" 2>/dev/null || true
+        isoinfo -i "$iso" -x "/BOOT/KUBESOLO-OS.GZ;1" > "$extract_dir/boot/kubesolo-os.gz" 2>/dev/null || true
+        if [ -s "$extract_dir/boot/vmlinuz" ] && [ -s "$extract_dir/boot/kubesolo-os.gz" ]; then
+            echo "    Extracted via isoinfo"
+            extracted=1
+        else
+            rm -f "$extract_dir/boot/vmlinuz" "$extract_dir/boot/kubesolo-os.gz"
+        fi
+    fi
+
+    # Method 3: loop mount (Linux only, may need root)
+    if [ $extracted -eq 0 ] && [ "$(uname)" = "Linux" ]; then
+        local iso_mount="$extract_dir/mnt"
+        mkdir -p "$iso_mount"
+        if mount -o loop,ro "$iso" "$iso_mount" 2>/dev/null; then
+            mkdir -p "$extract_dir/boot"
+            cp "$iso_mount/boot/vmlinuz" "$extract_dir/boot/" 2>/dev/null || true
+            cp "$iso_mount/boot/kubesolo-os.gz" "$extract_dir/boot/" 2>/dev/null || true
+            umount "$iso_mount" 2>/dev/null || true
+            if [ -f "$extract_dir/boot/vmlinuz" ] && [ -f "$extract_dir/boot/kubesolo-os.gz" ]; then
+                echo "    Extracted via loop mount"
+                extracted=1
+            fi
+        fi
+    fi
+
+    if [ $extracted -eq 0 ]; then
+        echo "ERROR: Failed to extract kernel/initramfs from ISO."
+        echo "  Install one of: bsdtar (libarchive-tools), isoinfo (genisoimage), or run as root for loop mount."
+        return 1
+    fi
+
+    VMLINUZ="$extract_dir/boot/vmlinuz"
+    INITRAMFS="$extract_dir/boot/kubesolo-os.gz"
+    return 0
+}
+
+# detect_kvm — prints "-enable-kvm" if KVM available, empty string otherwise
+detect_kvm() {
+    if [ -w /dev/kvm ] 2>/dev/null; then
+        echo "-enable-kvm"
+    fi
+}