fix: kernel AppArmor 2-pass olddefconfig and QEMU test direct kernel boot

The stock TinyCore kernel config has "# CONFIG_SECURITY is not set" which
caused make olddefconfig to silently revert all security configs in a single
pass. Fix by applying security configs (AppArmor, Audit, LSM) after the
first olddefconfig resolves base dependencies, then running a second pass.
Added mandatory verification that exits on missing critical configs.

All QEMU test scripts converted from broken -cdrom + -append pattern to
direct kernel boot (-kernel + -initrd) via shared test/lib/qemu-helpers.sh
helper library. The -append flag only works with -kernel, not -cdrom.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/qemu/test-boot.sh

@@ -8,13 +8,17 @@ ISO="${1:?Usage: $0 <path-to-iso>}"
 TIMEOUT_BOOT=${TIMEOUT_BOOT:-120}   # seconds to wait for boot success marker
 SERIAL_LOG=$(mktemp /tmp/kubesolo-boot-test-XXXXXX.log)
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+. "$SCRIPT_DIR/../lib/qemu-helpers.sh"
+
 # Temp data disk
 DATA_DISK=$(mktemp /tmp/kubesolo-data-XXXXXX.img)
 dd if=/dev/zero of="$DATA_DISK" bs=1M count=512 2>/dev/null
 mkfs.ext4 -q -L KSOLODATA "$DATA_DISK" 2>/dev/null
 
-EXTRACT_DIR=""
 QEMU_PID=""
+EXTRACT_DIR=""
 
 cleanup() {
     [ -n "$QEMU_PID" ] && kill "$QEMU_PID" 2>/dev/null || true
@@ -27,78 +31,15 @@ echo "==> Boot test: $ISO"
 echo "    Timeout: ${TIMEOUT_BOOT}s"
 echo "    Serial log: $SERIAL_LOG"
 
-# Extract kernel + initramfs from ISO (direct kernel boot required for -append)
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-ROOTFS_DIR="${ROOTFS_DIR:-$PROJECT_ROOT/build/rootfs-work}"
+# Extract kernel from ISO
+EXTRACT_DIR="$(mktemp -d /tmp/kubesolo-extract-XXXXXX)"
+extract_kernel_from_iso "$ISO" "$EXTRACT_DIR"
 
-VMLINUZ=""
-INITRAMFS=""
-
-if [ -f "$ROOTFS_DIR/vmlinuz" ] && [ -f "$ROOTFS_DIR/kubesolo-os.gz" ]; then
-    VMLINUZ="$ROOTFS_DIR/vmlinuz"
-    INITRAMFS="$ROOTFS_DIR/kubesolo-os.gz"
-    echo "    Using kernel/initramfs from build directory"
-else
-    EXTRACT_DIR="$(mktemp -d /tmp/kubesolo-extract-XXXXXX)"
-    EXTRACTED=0
-
-    echo "    Extracting kernel/initramfs from ISO..."
-
-    # Method 1: bsdtar
-    if [ $EXTRACTED -eq 0 ] && command -v bsdtar >/dev/null 2>&1; then
-        if bsdtar -xf "$ISO" -C "$EXTRACT_DIR" boot/vmlinuz boot/kubesolo-os.gz 2>/dev/null; then
-            echo "    Extracted via bsdtar"
-            EXTRACTED=1
-        fi
-    fi
-
-    # Method 2: isoinfo
-    if [ $EXTRACTED -eq 0 ] && command -v isoinfo >/dev/null 2>&1; then
-        mkdir -p "$EXTRACT_DIR/boot"
-        isoinfo -i "$ISO" -x "/BOOT/VMLINUZ;1" > "$EXTRACT_DIR/boot/vmlinuz" 2>/dev/null || true
-        isoinfo -i "$ISO" -x "/BOOT/KUBESOLO-OS.GZ;1" > "$EXTRACT_DIR/boot/kubesolo-os.gz" 2>/dev/null || true
-        if [ -s "$EXTRACT_DIR/boot/vmlinuz" ] && [ -s "$EXTRACT_DIR/boot/kubesolo-os.gz" ]; then
-            echo "    Extracted via isoinfo"
-            EXTRACTED=1
-        else
-            rm -f "$EXTRACT_DIR/boot/vmlinuz" "$EXTRACT_DIR/boot/kubesolo-os.gz"
-        fi
-    fi
-
-    # Method 3: loop mount (Linux only)
-    if [ $EXTRACTED -eq 0 ] && [ "$(uname)" = "Linux" ]; then
-        ISO_MOUNT="$EXTRACT_DIR/mnt"
-        mkdir -p "$ISO_MOUNT"
-        if mount -o loop,ro "$ISO" "$ISO_MOUNT" 2>/dev/null; then
-            mkdir -p "$EXTRACT_DIR/boot"
-            cp "$ISO_MOUNT/boot/vmlinuz" "$EXTRACT_DIR/boot/" 2>/dev/null || true
-            cp "$ISO_MOUNT/boot/kubesolo-os.gz" "$EXTRACT_DIR/boot/" 2>/dev/null || true
-            umount "$ISO_MOUNT" 2>/dev/null || true
-            if [ -f "$EXTRACT_DIR/boot/vmlinuz" ] && [ -f "$EXTRACT_DIR/boot/kubesolo-os.gz" ]; then
-                echo "    Extracted via loop mount"
-                EXTRACTED=1
-            fi
-        fi
-    fi
-
-    if [ $EXTRACTED -eq 0 ]; then
-        echo "ERROR: Failed to extract kernel/initramfs from ISO."
-        exit 1
-    fi
-
-    VMLINUZ="$EXTRACT_DIR/boot/vmlinuz"
-    INITRAMFS="$EXTRACT_DIR/boot/kubesolo-os.gz"
-fi
-
-# Detect KVM
-KVM_FLAG=""
-if [ -w /dev/kvm ] 2>/dev/null; then
-    KVM_FLAG="-enable-kvm"
-    echo "    KVM acceleration: enabled"
-fi
+KVM_FLAG=$(detect_kvm)
+[ -n "$KVM_FLAG" ] && echo "    KVM acceleration: enabled"
 
 # Launch QEMU in background with direct kernel boot
+# shellcheck disable=SC2086
 qemu-system-x86_64 \
     -m 2048 -smp 2 \
     -nographic \