feat(time-model): gate the pinned guest time model on x86-64 Linux

[darwin67]

Implements RFD 4 Phase 0 — Pin and validate the time model, and records the
record-mode limitation that blocks pinning it in the product.

Pinned model as implemented: -icount shift=4,sleep=off, recorded in
poc/time-model/reference-host-values.txt as the single source of truth for the
gate. The product's launch model stays TIME_MODEL = "shift=auto" in
crates/simferret/src/vm.rs; see "Record mode cannot use the pinned model"
below for why, and for the spike that shows the blocker is one early return in
QEMU.

What changed

• scripts/time-model-gate.sh — the acceptance gate: runs the real probe under
  the pinned model with a fixed 180 s deadline and the RFD's five-run minimum,
  and fails unless every requested run completed, the verdict is an explicit
  reproducible, the QEMU executable, guest kernel, and initramfs digests match
  the reference host's, and the four time measurements and control checksum equal
  its recorded values exactly. A host that cannot complete fails as an
  unsupported execution; no fallback model is attempted.
• poc/time-model/reference-host-values.txt — the model, artifact digests (QEMU
  by executable SHA-256, not version string), and the measurements a host must
  reproduce.
• scripts/time-model-input-probe.sh + poc/time-model/input-probe.c — measures
  whether a guest that waits for host input receives it, with a causal ordering:
  the guest polls until the probe stops it; the probe stops the guest with an
  acknowledged QMP command, drains what it produced before it stopped, writes the
  line, and resumes it with a second acknowledged command, so the polling after
  the resume is provably after the write; and it then stops the emulator and reads
  its output to its end, so a delivery report emitted during shutdown is
  classified rather than lost. A non-delivery claim needs that clean end of
  output, and a guest that stopped polling, an emulator that exited on its own, an
  output that never ended or ended mid-report, an expired emulator deadline, or an
  experiment that never wrote is inconclusive, never not-delivered.
• poc/time-model/input-probe-test.c + scripts/time-model-input-probe-test.sh
  — drive the real guest loop through stubs: a line arriving after more than the
  polls the guest used to stop after is still reported as received, and the guest
  never reports giving up.
• poc/time-model/qemu-nosleep-replay-flush.patch + qemu-nosleep-replay-spike.nix
  — the spike that builds the pinned QEMU with a ten-line patch moving the replay
  flush ahead of the sleep check. Not wired into any build.
• .github/workflows/ci.yml — the qemu-replay job runs the gate, its
  regression tests, the guest tests, and the host-input assertion
  (--expect not-delivered) on x86-64 Linux.
• rfd/0004/EVIDENCE.adoc — scale selection, Phase 0 validation on the reference
  host, cross-host equality, the record-mode limitation with its minimal
  reproduction, the spike measurements, and the re-validation trigger.
• docs/time-model.adoc — the investigation index, including the gate.

Scope boundaries

• Phase 1 is not implemented here: the typed time-model field in VM identity,
  pre-launch rejection of a mismatched manifest, and the legacy profile.
• Phase 2 is not implemented here: documenting the model's idle-advancement
  and wakeup semantics in the README and the run manifest.
• The product's launch model is unchanged (shift=auto). Phase 0's product
  pin and the record/replay confirmation are blocked by the record-mode
  limitation recorded in the evidence; the model question and whether to carry a
  patched QEMU are the RFD's decision.

Verification

• Reference host (x86-64 Linux, QEMU 11.1.0, guest kernel 6.18.49):
  scripts/time-model-gate.sh — 5/5 runs completed, verdict reproducible, all
  measurements equal to the reference record.
• scripts/time-model-input-probe.sh --expect not-delivered — not delivered; the
  guest polled for 84 s (32,120 polls) and never received the line. The controls
  (--live, shift=4, shift=auto) deliver.
• Against the spike's patched QEMU: the input probe delivers, the gate passes
  against a record carrying the patched digest, the product records and replays
  twice with matching normalized events, assertions, and semantic outcome digest
  (see the evidence table).
• scripts/time-model-gate-test.sh, time-model-probe-test.sh,
  time-model-input-probe-test.sh — pass.
• The repository's checks: flake check, cargo fmt --check, clippy with
  --deny warnings, cargo test --locked --workspace --all-targets --all-features,
  bash -n .agents/dev .agents/setup scripts/*.sh, make check-rfds, the
  record/replay smoke suites, both acceptance suites, and the two sudo runtime
  suites — pass.
• The ubuntu-latest half of the matrix is validated by this PR's qemu-replay
  job: all six checks pass, including the gate, the host-input assertion (with the
  acknowledged-QMP ordering), and the host-input guest tests —
  https://github.com/chaba-dev/simferret/actions/runs/35710675048
• The record/replay smoke suites, both acceptance suites, the RFD 3 phase 2 and
  phase 4 runtime suites (under sudo), flake check, cargo fmt --check, clippy
  with --deny warnings, the workspace test suite, bash -n, and
  make check-rfds all pass on the reference host.
• Not covered: a harness fixture for a delayed monitor pause was written and
  dropped, because its timing could not be made to distinguish the acknowledgement
  from the delay reliably; the acknowledgement itself is asserted through the
  monitor log in the handshake case. QEMU's own serial-output path is treated as
  synchronous (its stdio backend writes through io_channel_send), which is what
  lets a drained pipe be the pre-write boundary.

This branch was stacked on #44 (the RFD 4 evidence and the investigation
index); #44 has since been merged into main, and the branch is rebased onto
that merge, so it is no longer stacked on an open PR.