fix(qemu): resolve 23 bugs from deep code review

CRITICAL:
- inject_fault.py: make nvs_corrupt write actual bytes via --flash arg;
  heap_exhaust and corrupt_frame now pause VM with honest WARNING about
  GDB stub requirement for real memory writes
- firmware-qemu.yml: remove github.run_id from cache key (was causing
  100% cache miss rate, rebuilding QEMU every run)
- mock_csi.c: change scenario_elapsed_ms() to int64_t (uint32 wrapped
  at ~49 days)

HIGH:
- qemu-mesh-test.sh: pass --results flag to validate_mesh_test.py
  (was passing positional arg to named-only parameter)
- test/Makefile: separate corpus directories per fuzz target
  (corpus_serialize/, corpus_edge/, corpus_nvs/)
- qemu-snapshot-test.sh: replace log truncation with tail-based
  extraction (truncation created sparse file while QEMU held fd)

MEDIUM:
- mock_csi.c: reset s_mac_filter_initialized in mock_csi_init()
- mock_csi.c: fix LFSR polynomial comment (32,31,29,1 not 32,22,2,1)
- sdkconfig.coverage: add FreeRTOS timer stack 4096 and WDT tuning
- firmware-qemu.yml: replace continue-on-error with FUZZER_CRASH env
- qemu-chaos-test.sh: rename heap_pressure to heap_exhaust for consistency
- validate_qemu_output.py: fix docstring "14 checks" -> "16 checks"
- generate_nvs_matrix.py: deduplicate temp file cleanup paths

LOW:
- mock_csi.c: remove M_PI float suffix, fix overflow burst flag
- qemu-snapshot-test.sh: fix now_ms() for macOS date +%s%N
- ADR-061: fix scenario 8 RSSI range to -90...-10 dBm
- launch.json: remove contradictory compound debug config

Co-Authored-By: claude-flow <ruv@ruv.net>

scripts/qemu-snapshot-test.sh

@@ -97,9 +97,11 @@ trap cleanup EXIT INT TERM
 # ──────────────────────────────────────────────────────────────────────
 
 now_ms() {
-    # Millisecond timestamp (portable: uses date +%s%N on Linux, perl fallback)
-    if date +%s%N &>/dev/null; then
-        echo $(( $(date +%s%N) / 1000000 ))
+    # Millisecond timestamp (portable: Linux date +%s%N, macOS perl fallback)
+    local ns
+    ns=$(date +%s%N 2>/dev/null)
+    if [[ "$ns" =~ ^[0-9]+$ ]]; then
+        echo $(( ns / 1000000 ))
     else
         perl -MTime::HiRes=time -e 'printf "%d\n", time()*1000' 2>/dev/null || \
             echo $(( $(date +%s) * 1000 ))
@@ -284,15 +286,15 @@ for test_name in "${TESTS[@]}"; do
     # Restore to post_first_frame state
     restore_snapshot "post_first_frame"
 
-    # Clear the UART log for this test segment
-    > "$LOG_DIR/qemu_uart.log"
+    # Record current log length so we can extract only new lines
+    pre_lines=$(wc -l < "$LOG_DIR/qemu_uart.log" 2>/dev/null || echo 0)
 
     # Let execution continue for TIMEOUT_SEC seconds
     echo "[test] Running for ${TIMEOUT_SEC}s..."
     sleep "$TIMEOUT_SEC"
 
-    # Capture the log segment for this test
-    cp "$LOG_DIR/qemu_uart.log" "$test_log"
+    # Capture only the new log lines produced during this test
+    tail -n +$((pre_lines + 1)) "$LOG_DIR/qemu_uart.log" > "$test_log"
 
     t_end=$(now_ms)
     elapsed_ms=$((t_end - t_start))