[Enhancement] amd64 QEMU functional-test path + auto-install host prereqs (#434)

[mcdope]

Summary

Adds an amd64 (x86_64) QEMU full-system functional-test path, mirroring the existing
arm64/armhf golden-image strategy, plus auto-installation of host QEMU prerequisites
so downstream packagers can reproduce the whole functional suite locally with no CI setup.

Closes #434.

What changed

• tests/can-actually-be-used/run-tests-in-qemu.sh
  • New amd64) case: qemu-system-x86_64 on -M q35 -cpu max -smp 2 -m 2048,
    default SeaBIOS (no -bios/OVMF), virtio-blk-pci / virtio-net-pci,
    PROVISION_VERSION=1.
  • Pre-flight now auto-installs the per-arch host packages (HOST_PKGS) via
    apt-get when the emulator / qemu-img / cloud-localds is missing, with a clear
    manual fallback for non-apt hosts (e.g. NixOS). Header/usage/message updates; removed
    stale ppc64el/riscv64 install hints (those QEMU functional tests were dropped earlier).
• Makefile — build-debian-amd64 alias (native build already emits the amd64 .deb)
  and an amd64 step in provision-qemu-images.
• .github/workflows/package-with-docker-on-own-server.yml — new FunctionalTest-amd64
  job, serialized after FunctionalTest-armhf on the shared runner.

Why this approach

• Reuse, not reinvent: the arm64/armhf golden-image + run-tests-in-qemu.sh pattern
  already exists and is proven; amd64 slots into it as another case block. The big win
  for packagers (esp. NixOS, read-only Nix store) is that dummy_hcd is built inside
  the VM, so the host never needs that out-of-tree kernel module.
• SeaBIOS over OVMF: SeaBIOS + q35 boots the Ubuntu amd64 cloud image reliably under
  TCG (the runner has no KVM) and needs no extra firmware package. Verified end-to-end
  (see below), so the added ovmf dependency the issue suggested was avoided.
• Serialized, runs on PRs: needs: [Debian, FunctionalTest-armhf] keeps only one
  full-system QEMU VM on the single shared runner at a time. if: ${{ !cancelled() }}
  makes it run on PRs too (on push it waits for armhf; on a PR armhf is skipped and this
  still runs after Debian).
• Auto-install prereqs: the pre-flight previously only checked and printed hints,
  so a newcomer hit an error and had to hand-install. It now installs them (apt hosts) or
  degrades gracefully (NixOS provides qemu via nix-shell) — the "single command"
  reproducibility the issue asks for.

Note on the issue text vs. reality

The issue was written against an idealized state that never landed: it referenced a
4-arch QEMU base and a build-and-test-cross-arch.yml file. In the actual tree only
arm64/armhf QEMU functional tests exist (ppc64el dropped entirely, riscv64 packaging-only),
the jobs live in package-with-docker-on-own-server.yml, and each case sets its own
PROVISION_VERSION as the first line (the CI golden-image check greps -A1 '<arch>)' for
it). This PR follows the real pattern.

Testing & proof of execution

Provisioned and ran on the project CI runner (Ubuntu 22.04, TCG / no KVM):

1. Provisioning (run-tests-in-qemu.sh --provision amd64, the make provision-qemu-images
   path) built jammy-amd64-provisioned-v1.qcow2 (valid qcow2, 10.2 GiB virtual / 1.39 GiB
   on disk). The dummy_hcd DKMS module built and installed cleanly inside the VM.
2. Full functional suite in the amd64 QEMU VM: FUNCTEST_EXIT=0, all 50 checks
   PASSED! — every filesystem iteration (vfat / ext4 / exfat), deny_remote/XRDP
   denial + logging, OTP pad load/match/expiry, and the pamusb-agent plug/unplug trigger
   ("Lock event found / Unlock event found").
3. make test — C (cmocka), Python (pytest) and shell suites pass, except 2 evdev
   unit tests (test_safe_no_helper_virtual_device_detected,
   test_safe_no_helper_all_eacces_inconclusive) that fail identically on master under
   the local GCC-13 toolchain (a --wrap/LTO harness quirk). This PR makes no src/
   changes, so it neither causes nor addresses them; the authoritative run is the CI
   Gate job on ubuntu-22.04/GCC-11, which is green.

Because FunctionalTest-amd64 now runs on PRs, this PR's own CI run will produce a
linkable green amd64 functional-test job (the runner's golden image already exists).

Integration test

This change is the integration test — it extends the functional/QEMU suite to amd64.
No new config options; manpages unaffected.

Security

CI/test-harness only — no security-relevant src/ code touched. The new auto-install runs
sudo apt-get install on the user's host only when the QEMU tooling is missing and
apt-get exists, printing exactly what it installs and falling back to a manual message
otherwise (a dev/test-harness convenience, not production/PAM code).

---

🤖 This PR was generated with the assistance of Claude (Claude Code). A human reviewed
and takes responsibility for every line.

I have read the rules