Phase 8 C (1/n): QEMU harness now preserves NVRAM across runs

Scoping Phase C (the MINT word) surfaced a real blocker: "mint one
Zuse, ever" needs the cert to survive reboots, but the qemu target
copied a fresh, pristine OVMF_VARS.fd on every invocation -- a
UEFI-NVRAM-based cert would never persist under this project's own
normal test workflow. Digging further, aarch64 had no persistent NVRAM
store at all (single -bios arg, no split VARS pflash like amd64/riscv64).

Fixed rather than switching storage substrates: amd64/riscv64 now only
copy the VARS template if the destination doesn't already exist, so
`clean` (which deletes the whole build tree) is the bleach step and a
bare `make qemu` preserves NVRAM -- matching the existing "always clean
before qemu" acceptance convention exactly. aarch64 restructured to
split CODE(ro)/VARS(rw) pflash drives matching the other two, with a
graceful fallback to the old -bios mode on hosts without split firmware.

Also resolves two design questions before any cert code: Zuse doesn't
need Milestone 6's CA (that's the capsule-signing chain, a separate
trust domain -- Zuse is a self-sovereign instance-local root of trust),
and flags that this session's own earlier vm_zuse_cert_install() storage
(16 bytes) is too small for a real Ed25519 keypair.

Verified: all three architectures boot clean to ok> with the new pflash
arrangement, Stadium conservation intact, no panics or guest errors.
Infrastructure-only -- no cert code yet. Documented in FABRIC-3.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U14ET9CWAtbQMbYqomKgXd

Makefile.starkernel

@@ -737,7 +737,9 @@ ifeq ($(ARCH),amd64)
 		-o $(QEMU_ISO) $(BUILD_DIR)/iso 2>&1
 	@if [ ! -f $(OVMF_CODE) ];    then echo "Error: $(OVMF_CODE) not found";    exit 1; fi
 	@if [ ! -f $(OVMF_VARS_RO) ]; then echo "Error: $(OVMF_VARS_RO) not found"; exit 1; fi
-	@cp $(OVMF_VARS_RO) $(BUILD_DIR)/OVMF_VARS.fd
+	@if [ ! -f $(BUILD_DIR)/OVMF_VARS.fd ]; then \
+		cp $(OVMF_VARS_RO) $(BUILD_DIR)/OVMF_VARS.fd; \
+	fi
 	@mkdir -p $(QEMU_LOG_DIR) $(DOE_RUNS_DIR) $(DOE_LATEST_DIR)
 	@TS=$$(date +%Y%m%d-%H%M%S); \
 	SESSION=$(QEMU_LOG_DIR)/$$TS; \
@@ -798,14 +800,26 @@ else ifeq ($(ARCH),aarch64)
 	@mkdir -p $(QEMU_LOG_DIR) $(DOE_RUNS_DIR) $(DOE_LATEST_DIR)
 	@if [ -f /usr/share/AAVMF/AAVMF_CODE.fd ]; then \
 		AAVMF_CODE=/usr/share/AAVMF/AAVMF_CODE.fd; \
+		AAVMF_VARS_RO=/usr/share/AAVMF/AAVMF_VARS.fd; \
 	elif [ -f /usr/share/qemu-efi-aarch64/QEMU_EFI.fd ]; then \
 		AAVMF_CODE=/usr/share/qemu-efi-aarch64/QEMU_EFI.fd; \
+		AAVMF_VARS_RO=/usr/share/qemu-efi-aarch64/vars-template-pflash.raw; \
 	elif [ -f /usr/share/qemu/edk2-aarch64-code.fd ]; then \
 		AAVMF_CODE=/usr/share/qemu/edk2-aarch64-code.fd; \
+		AAVMF_VARS_RO=/usr/share/qemu/edk2-aarch64-vars.fd; \
 	else \
 		echo "Error: aarch64 UEFI firmware not found. Install qemu-efi-aarch64."; \
 		exit 1; \
 	fi; \
+	if [ -f "$$AAVMF_VARS_RO" ]; then \
+		if [ ! -f $(BUILD_DIR)/AAVMF_VARS.fd ]; then \
+			cp $$AAVMF_VARS_RO $(BUILD_DIR)/AAVMF_VARS.fd; \
+		fi; \
+		AAVMF_VARS=$(BUILD_DIR)/AAVMF_VARS.fd; \
+	else \
+		echo "  (no split VARS template found for this firmware -- NVRAM will not persist across runs)"; \
+		AAVMF_VARS=""; \
+	fi; \
 	TS=$$(date +%Y%m%d-%H%M%S); \
 	SESSION=$(QEMU_LOG_DIR)/$$TS; \
 	mkdir -p $$SESSION/aarch64; \
@@ -824,7 +838,11 @@ else ifeq ($(ARCH),aarch64)
 	qemu-system-aarch64 \
 		-machine virt \
 		-cpu cortex-a57 \
-		-bios $$AAVMF_CODE \
+		$$(if [ -n "$$AAVMF_VARS" ]; then \
+			echo "-drive if=pflash,format=raw,readonly=on,file=$$AAVMF_CODE -drive if=pflash,format=raw,file=$$AAVMF_VARS"; \
+		else \
+			echo "-bios $$AAVMF_CODE"; \
+		fi) \
 		-drive if=virtio,format=raw,file=$(QEMU_ISO),media=cdrom \
 		-drive id=artdisk,file=$(ARTDISK),format=raw,if=none \
 		-device virtio-blk-pci,drive=artdisk \
@@ -865,7 +883,9 @@ else ifeq ($(ARCH),riscv64)
 	fi; \
 	EDK2_RISCV_VARS=""; \
 	if [ -f /usr/share/qemu-efi-riscv64/RISCV_VIRT_VARS.fd ]; then \
-		cp /usr/share/qemu-efi-riscv64/RISCV_VIRT_VARS.fd $(BUILD_DIR)/RISCV_VARS.fd; \
+		if [ ! -f $(BUILD_DIR)/RISCV_VARS.fd ]; then \
+			cp /usr/share/qemu-efi-riscv64/RISCV_VIRT_VARS.fd $(BUILD_DIR)/RISCV_VARS.fd; \
+		fi; \
 		EDK2_RISCV_VARS=$(BUILD_DIR)/RISCV_VARS.fd; \
 	fi; \
 	DISK=$(BUILD_DIR)/starkernel_rv64.img; \