fix: Go version, test scripts, and shellcheck warnings from validation

- Dockerfile.builder: Go 1.24.0 → 1.25.5 (go.mod requires it)
- test-boot.sh: use direct kernel boot via ISO extraction instead of
  broken -cdrom + -append; fix boot marker to "KubeSolo is running"
  (Stage 90 blocks on wait, never emits "complete")
- test-security-hardening.sh: same direct kernel boot and marker fixes
- run-vm.sh, dev-vm.sh, dev-vm-arm64.sh: quote QEMU -net args to
  silence shellcheck SC2054
- fetch-components.sh, fetch-rpi-firmware.sh, dev-vm-arm64.sh: fix
  trap quoting (SC2064)

Validated: full Docker build, 94 Go tests pass, QEMU boot (73s),
security hardening test (6/6 pass, 1 AppArmor skip pending kernel
rebuild).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hack/dev-vm.sh

@@ -85,8 +85,8 @@ trap cleanup EXIT
 
 # Build QEMU command
 QEMU_ARGS=(-m 2048 -smp 2 -nographic -cpu max)
-QEMU_ARGS+=(-net nic,model=virtio)
-QEMU_ARGS+=(-net user,hostfwd=tcp::6443-:6443,hostfwd=tcp::2222-:22,hostfwd=tcp::8080-:8080)
+QEMU_ARGS+=(-net "nic,model=virtio")
+QEMU_ARGS+=(-net "user,hostfwd=tcp::6443-:6443,hostfwd=tcp::2222-:22,hostfwd=tcp::8080-:8080")
 
 if [ -n "$DATA_DISK" ]; then
     QEMU_ARGS+=(-drive "file=$DATA_DISK,format=raw,if=virtio")