feat(firmware): QEMU ESP32-S3 testing platform (ADR-061)

Implement full QEMU emulation framework for firmware testing without
physical hardware:

Mock CSI Generator (mock_csi.c):
- 10 test scenarios: empty room, static/walking person, fall, multi-person,
  channel sweep, MAC filter, ring overflow, boundary RSSI, zero-length
- Physics-based signal model with breathing modulation and Doppler
- LFSR pseudo-random noise, CONFIG_CSI_MOCK_ENABLED Kconfig guard
- Scenario 255 runs all sequentially

QEMU Runner & CI:
- qemu-esp32s3-test.sh: build, merge flash image, run QEMU, validate
- validate_qemu_output.py: 14 automated checks (boot, NVS, edge, vitals,
  crash detection) with colored output and severity-based exit codes
- generate_nvs_matrix.py: 14 NVS provisioning configs for matrix testing
- firmware-qemu.yml: GitHub Actions CI with 4-scenario matrix

Fuzz Testing:
- 3 libFuzzer targets: CSI serialize, NVS config validation, ring buffer
- Host-compilable ESP-IDF stubs (no ESP-IDF dependency for fuzzing)
- 6 seed corpus files for guided fuzzing
- Makefile with ASAN + UBSAN sanitizers

Documentation:
- firmware/esp32-csi-node/README.md: comprehensive QEMU testing guide
- Root README.md: collapsed QEMU testing section

Build verified: normal firmware build (RC=0) with mock_csi excluded.

Closes #259

Co-Authored-By: claude-flow <ruv@ruv.net>

firmware/esp32-csi-node/main/Kconfig.projbuild

@@ -201,3 +201,40 @@ menu "WASM Programmable Sensing (ADR-040)"
             Default 1000 ms = 1 Hz.
 
 endmenu
+
+menu "Mock CSI (QEMU Testing)"
+    config CSI_MOCK_ENABLED
+        bool "Enable mock CSI generator (for QEMU testing)"
+        default n
+        help
+            Replace real WiFi CSI with synthetic frame generator.
+            Use with QEMU emulation for automated testing.
+
+    config CSI_MOCK_SKIP_WIFI_CONNECT
+        bool "Skip WiFi STA connection"
+        depends on CSI_MOCK_ENABLED
+        default y
+        help
+            Skip WiFi initialization when using mock CSI.
+
+    config CSI_MOCK_SCENARIO
+        int "Mock scenario (0-9, 255=all)"
+        depends on CSI_MOCK_ENABLED
+        default 255
+        range 0 255
+        help
+            0=empty, 1=static, 2=walking, 3=fall, 4=multi-person,
+            5=channel-sweep, 6=mac-filter, 7=ring-overflow,
+            8=boundary-rssi, 9=zero-length, 255=run all.
+
+    config CSI_MOCK_SCENARIO_DURATION_MS
+        int "Scenario duration (ms)"
+        depends on CSI_MOCK_ENABLED
+        default 5000
+        range 1000 60000
+
+    config CSI_MOCK_LOG_FRAMES
+        bool "Log every mock frame (verbose)"
+        depends on CSI_MOCK_ENABLED
+        default n
+endmenu