Establish and validate a dinit-based Mere test system #634

Part of #633. Assemble a test guest using Mere's kernel and packages, with dinit as PID 1 and a disk-backed root, without an initramfs. Direct QEMU kernel loading does not validate the bootloader.

Implemented: harness #637, mere-boot recipes #641, published-package launcher #642, lifecycle and package-generation scenario #643. Recovery uses unpatched dinit's boot-failure menu (select e) with --auto-recovery disabled; #640 is closed without merge.

Acceptance:

• Define the production minimum boot-service graph, filesystem setup, console access, and shutdown requirements with the maintainer.
• Assemble a disposable root filesystem without legacy pacman/extlinux scripts or privileged host mounts.
• Boot Mere's published kernel from ext4 with dinit as PID 1 and request power-off through dinit using test services.
• Verify the agreed minimum graph's shutdown ordering, persistent root filesystem integrity, and reboot behavior.
• Verify start/stop/restart, enable/disable boot intent independently of live state, and status/log output.
• Exercise package install/upgrade/removal and generation activation/rollback with Complete package-manager integration for the dinit-only distro mere#63 (stopped-service transactions).
• Record initial commands, versions, and observed guest results in the harness documentation.

Agreed minimum boot contract:

• Local-disk boot without an initramfs; dinit remains PID 1.
• Establish procfs, sysfs, devtmpfs, /run, devpts, shared memory, writable root, and required local fstab mounts.
• mdevd readiness followed by coldplug before device-dependent local mounts.
• Hostname/sysctl setup, runtime directories and permissions, configured swap, and usable console/service diagnostics.
• Authenticated tty1 login by default; serial getty is an explicit machine option, enabled for the QEMU configuration.
• Required foundational failures prevent normal boot completion and offer authenticated recovery through dinit's console menu. Preserve diagnostics and never trigger an automatic reboot loop.
• Stop services before filesystem teardown; disable swap, sync, unmount/remount read-only, and power off or reboot.
• Networking, SSH, time synchronization, D-Bus, desktop services, and cgroup policy are outside this minimum.

Local x86_64 guest results (QEMU 8.2.2 TCG, Linux 6.18.42-2, BusyBox 1.37.0-10, dinit 0.22.1-1, Shadow 4.19.4-2, mdevd 0.1.8.1-2, mere-boot 0.1.0-1) cover packaged boot, serial login, reboot with persistent data, failed-mount recovery through the menu, and the stopped-service lifecycle scenario, each with clean pre/post e2fsck -fn. They are not CI results.

Remaining: guest validation of the essential-service and running-service behavior implemented in jhuntwork/mere#76, broader failure/device/filesystem/architecture coverage, and bootloader testing.