ci: pin CapOS baseline and stabilize QEMU guest scripts

[fwerkor]

Summary

• pin the CapOS dependency baseline used by ArgosFS Full QEMU and weekly workflows to CapOS commit 3903b2968a692fdc77e05f63eb3a1cfa9a739999
• replace fixed-delay, line-by-line QEMU console injection with a two-stage guest shell/upload handshake
• preserve already-open block-device handles across switch_root instead of reopening vanished initramfs /dev paths
• add a regression that moves the backing image after opening and verifies writes, group commit, audit, clean unmount, and reopen

Why

The CapOS baseline commit tracks ArgosFS main while ArgosFS CI remains reproducible against an immutable CapOS revision.

The previous QEMU harness could interleave commands or mistake echoed source text for executed markers. The new transport waits for an exact shell response, disables echo, uploads a complete script, then executes it.

Full CapOS QEMU then exposed a rootfs-specific regression in bounded group commit: after initramfs handed /dev to the real root with switch_root, deferred commits reopened device paths recorded as /dev/vda. Those paths belonged to the discarded initramfs mount namespace, so commits failed with ENOENT even though the original block-device file descriptors remained usable. The fixed paths reuse the backend opened at mount time whenever it covers the active superblocks; only newly added or replacement devices require path-based opening.

Validation

• reproduced the Full QEMU failure with the exact CI x86_64 bundle and entered OpenWrt failsafe
• observed repeated deferred group commit failed: ... No such file or directory after switch_root
• verified the image itself was complete: 1,150 files, 144 directories, clean preflight and fsck
• new path-disappearance regression failed before the fix and passes after it
• cargo test --locked --all-targets: 23 unit, 137 integration, 5 raw-readonly tests passed
• cargo clippy --locked --all-targets --all-features -- -D warnings
• bash -n and shellcheck -x on changed QEMU scripts
• focused two-stage QEMU shell/upload handshake test
• git diff --check

[fwerkor]

Local rootfs regression validation after 2fd709f:

• rebuilt a temporary x86_64 static-musl ArgosFS from the PR source
• overlaid it into both the exact failed rootfs bundle and an external uncompressed initramfs, so the actual mount-root daemon used the fix
• booted the exact failed CapOS kernel/rootfs under QEMU
• reached normal procd console successfully
• verified /etc, /bin/rm, and /run/argosfs-root-active
• created and synced persistent files, waited past the 5-second bounded commit interval, and read them back
• confirmed /run/argosfs-mount.log contained no deferred group commit failed

Markers: ARGOSFS_PATCHED_RUNTIME_BEGIN and ARGOSFS_PATCHED_RUNTIME_DONE.