fix: Go version, test scripts, and shellcheck warnings from validation

- Dockerfile.builder: Go 1.24.0 → 1.25.5 (go.mod requires it)
- test-boot.sh: use direct kernel boot via ISO extraction instead of
  broken -cdrom + -append; fix boot marker to "KubeSolo is running"
  (Stage 90 blocks on wait, never emits "complete")
- test-security-hardening.sh: same direct kernel boot and marker fixes
- run-vm.sh, dev-vm.sh, dev-vm-arm64.sh: quote QEMU -net args to
  silence shellcheck SC2054
- fetch-components.sh, fetch-rpi-firmware.sh, dev-vm-arm64.sh: fix
  trap quoting (SC2064)

Validated: full Docker build, 94 Go tests pass, QEMU boot (73s),
security hardening test (6/6 pass, 1 AppArmor skip pending kernel
rebuild).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hack/dev-vm-arm64.sh

@@ -74,7 +74,7 @@ fi
 DATA_DISK="$(mktemp /tmp/kubesolo-arm64-data-XXXXXX).img"
 dd if=/dev/zero of="$DATA_DISK" bs=1M count=1024 2>/dev/null
 "$MKFS_EXT4" -q -L KSOLODATA "$DATA_DISK" 2>/dev/null
-trap "rm -f '$DATA_DISK'" EXIT
+trap 'rm -f "$DATA_DISK"' EXIT
 
 echo "==> Launching ARM64 QEMU VM..."
 echo "    Kernel: $VMLINUZ"
@@ -96,5 +96,5 @@ qemu-system-aarch64 \
     -initrd "$INITRD" \
     -append "console=ttyAMA0 kubesolo.data=/dev/vda kubesolo.debug $EXTRA_APPEND" \
     -drive "file=$DATA_DISK,format=raw,if=virtio" \
-    -net nic,model=virtio \
+    -net "nic,model=virtio" \
     -net "user,hostfwd=tcp::6443-:6443,hostfwd=tcp::2222-:22"

hack/dev-vm.sh

@@ -85,8 +85,8 @@ trap cleanup EXIT
 
 # Build QEMU command
 QEMU_ARGS=(-m 2048 -smp 2 -nographic -cpu max)
-QEMU_ARGS+=(-net nic,model=virtio)
-QEMU_ARGS+=(-net user,hostfwd=tcp::6443-:6443,hostfwd=tcp::2222-:22,hostfwd=tcp::8080-:8080)
+QEMU_ARGS+=(-net "nic,model=virtio")
+QEMU_ARGS+=(-net "user,hostfwd=tcp::6443-:6443,hostfwd=tcp::2222-:22,hostfwd=tcp::8080-:8080")
 
 if [ -n "$DATA_DISK" ]; then
     QEMU_ARGS+=(-drive "file=$DATA_DISK,format=raw,if=virtio")