feat(firmware): complete ADR-061 QEMU testing platform (all 9 layers)

Fix 9 bugs (LFSR bias, MAC filter init, scenario loop, NVS boundary
values), add 7 new files completing Layers 3 (mesh), 4 (GDB), 5
(coverage), 8 (snapshots), 9 (chaos testing), expand CI with fuzz
and NVS validation jobs, update README with full platform overview.

Co-Authored-By: claude-flow <ruv@ruv.net>

scripts/qemu-esp32s3-test.sh

@@ -111,21 +111,26 @@ if ! command -v timeout &>/dev/null; then
 fi
 
 QEMU_EXIT=0
+
+# Common QEMU arguments
+QEMU_ARGS=(
+    -machine esp32s3
+    -nographic
+    -drive "file=$FLASH_IMAGE,if=mtd,format=raw"
+    -serial mon:stdio
+    -no-reboot
+)
+
+# Enable SLIRP user-mode networking for UDP if available
+if [ "${QEMU_NET:-1}" != "0" ]; then
+    QEMU_ARGS+=(-nic "user,model=open_eth,net=10.0.2.0/24,host=10.0.2.2")
+fi
+
 if [ -n "$TIMEOUT_CMD" ]; then
-    $TIMEOUT_CMD "$TIMEOUT_SEC" "$QEMU_BIN" \
-        -machine esp32s3 \
-        -nographic \
-        -drive file="$FLASH_IMAGE",if=mtd,format=raw \
-        -serial mon:stdio \
-        -no-reboot \
+    $TIMEOUT_CMD "$TIMEOUT_SEC" "$QEMU_BIN" "${QEMU_ARGS[@]}" \
         2>&1 | tee "$LOG_FILE" || QEMU_EXIT=$?
 else
-    "$QEMU_BIN" \
-        -machine esp32s3 \
-        -nographic \
-        -drive file="$FLASH_IMAGE",if=mtd,format=raw \
-        -serial mon:stdio \
-        -no-reboot \
+    "$QEMU_BIN" "${QEMU_ARGS[@]}" \
         2>&1 | tee "$LOG_FILE" || QEMU_EXIT=$?
 fi