fix(qemu): resolve 23 bugs from deep code review

CRITICAL:
- inject_fault.py: make nvs_corrupt write actual bytes via --flash arg;
  heap_exhaust and corrupt_frame now pause VM with honest WARNING about
  GDB stub requirement for real memory writes
- firmware-qemu.yml: remove github.run_id from cache key (was causing
  100% cache miss rate, rebuilding QEMU every run)
- mock_csi.c: change scenario_elapsed_ms() to int64_t (uint32 wrapped
  at ~49 days)

HIGH:
- qemu-mesh-test.sh: pass --results flag to validate_mesh_test.py
  (was passing positional arg to named-only parameter)
- test/Makefile: separate corpus directories per fuzz target
  (corpus_serialize/, corpus_edge/, corpus_nvs/)
- qemu-snapshot-test.sh: replace log truncation with tail-based
  extraction (truncation created sparse file while QEMU held fd)

MEDIUM:
- mock_csi.c: reset s_mac_filter_initialized in mock_csi_init()
- mock_csi.c: fix LFSR polynomial comment (32,31,29,1 not 32,22,2,1)
- sdkconfig.coverage: add FreeRTOS timer stack 4096 and WDT tuning
- firmware-qemu.yml: replace continue-on-error with FUZZER_CRASH env
- qemu-chaos-test.sh: rename heap_pressure to heap_exhaust for consistency
- validate_qemu_output.py: fix docstring "14 checks" -> "16 checks"
- generate_nvs_matrix.py: deduplicate temp file cleanup paths

LOW:
- mock_csi.c: remove M_PI float suffix, fix overflow burst flag
- qemu-snapshot-test.sh: fix now_ms() for macOS date +%s%N
- ADR-061: fix scenario 8 RSSI range to -90...-10 dBm
- launch.json: remove contradictory compound debug config

Co-Authored-By: claude-flow <ruv@ruv.net>

scripts/qemu-mesh-test.sh

@@ -11,7 +11,8 @@
 #
 # Environment variables:
 #   QEMU_PATH       - Path to qemu-system-xtensa (default: qemu-system-xtensa)
-#   MESH_TIMEOUT    - Timeout in seconds (default: 45)
+#   QEMU_TIMEOUT    - Timeout in seconds (default: 45)
+#   MESH_TIMEOUT    - Deprecated alias for QEMU_TIMEOUT
 #   SKIP_BUILD      - Set to "1" to skip the idf.py build step
 #   BRIDGE_NAME     - Bridge interface name (default: qemu-br0)
 #   BRIDGE_SUBNET   - Bridge IP/mask (default: 10.0.0.1/24)
@@ -391,7 +392,7 @@ VALIDATE_ARGS=("--nodes" "$N_NODES")
 
 # Pass results file if it was produced
 if [ -f "$RESULTS_FILE" ]; then
-    VALIDATE_ARGS+=("$RESULTS_FILE")
+    VALIDATE_ARGS+=("--results" "$RESULTS_FILE")
 else
     echo "WARNING: Aggregator results file not found: $RESULTS_FILE"
     echo "Validation will rely on node logs only."