fix: Go version, test scripts, and shellcheck warnings from validation

- Dockerfile.builder: Go 1.24.0 → 1.25.5 (go.mod requires it)
- test-boot.sh: use direct kernel boot via ISO extraction instead of
  broken -cdrom + -append; fix boot marker to "KubeSolo is running"
  (Stage 90 blocks on wait, never emits "complete")
- test-security-hardening.sh: same direct kernel boot and marker fixes
- run-vm.sh, dev-vm.sh, dev-vm-arm64.sh: quote QEMU -net args to
  silence shellcheck SC2054
- fetch-components.sh, fetch-rpi-firmware.sh, dev-vm-arm64.sh: fix
  trap quoting (SC2064)

Validated: full Docker build, 94 Go tests pass, QEMU boot (73s),
security hardening test (6/6 pass, 1 AppArmor skip pending kernel
rebuild).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

test/qemu/run-vm.sh

@@ -91,7 +91,7 @@ if [ "$ARCH" = "arm64" ] || [ "$ARCH" = "aarch64" ]; then
         -m "$MEMORY"
         -smp "$CPUS"
         -nographic
-        -net nic,model=virtio
+        -net "nic,model=virtio"
         -net "user,hostfwd=tcp::${API_PORT}-:6443,hostfwd=tcp::${SSH_PORT}-:22"
         -drive "file=$DATA_DISK,format=raw,if=virtio"
         -serial "file:$SERIAL_LOG"
@@ -114,7 +114,7 @@ else
         -m "$MEMORY"
         -smp "$CPUS"
         -nographic
-        -net nic,model=virtio
+        -net "nic,model=virtio"
         -net "user,hostfwd=tcp::${API_PORT}-:6443,hostfwd=tcp::${SSH_PORT}-:22"
         -drive "file=$DATA_DISK,format=raw,if=virtio"
         -serial "file:$SERIAL_LOG"