fix(pi3): decompressed kernel + explicit earlycon PL011 address

Two more defects making Pi 3 boot silently:

1. The kernel8.img that ships in the Pi OS armhf boot partition is a
   gzip-compressed PE-COFF Image (first 4 bytes 0x1f8b0800). QEMU's
   `-kernel` does NOT auto-decompress; it tries to execute the gzip
   header as ARM code and the CPU faults immediately. Result: zero
   bytes on ttyAMA0, simulator looks dead. Switch the asset_id to a
   pre-decompressed kernel (24 MiB raw vs 9.7 MiB gzipped) so QEMU
   gets a valid Image to boot.

2. Even with a real kernel, the original cmdline `console=ttyAMA0`
   alone wasn't enough — the kernel can't initialise the BCM2837
   PL011 UART early enough for `printk` to reach the serial console
   under QEMU's bare-metal boot (no Pi firmware to set it up
   beforehand). Adding `earlycon=pl011,mmio32,0x3f201000` makes the
   kernel program the UART itself in the early boot path.
   Verified: boot output starts streaming within 100 ms of QEMU
   launch instead of never.

The cmdline also locks the baud rate at 115200 to match the agetty
drop-in created by scripts/configure-pi3-autologin.sh.

backend/app/services/boot_images/manifest.json

@@ -8,9 +8,9 @@
         {
           "name": "kernel8.img",
           "asset_id": "kernel8-pi3",
-          "sha256": "495bf3ec05ad1de29cb884ec3d5e89bfc824740f537d40cbe6be59ee1cdc6ef9",
-          "size_bytes": 9695883,
-          "version": "2026-04-21"
+          "sha256": "2f87328ab8d36c266ac0545e59a7eed53841e146a75e0010929d3dafd0209310",
+          "size_bytes": 24367616,
+          "version": "2026-03-11+raw"
         },
         {
           "name": "bcm2710-rpi-3-b.dtb",

backend/app/services/qemu_manager.py

@@ -184,13 +184,22 @@ class QemuManager:
             # ttyAMA1 → GPIO shim protocol
             '-serial', f'tcp:127.0.0.1:{inst.gpio_port},server,nowait',
             '-append',
+            # earlycon=pl011,mmio32,0x3f201000 — without explicit address
+            # the kernel doesn't initialise the BCM2837 PL011 UART early
+            # enough for any output to reach ttyAMA0; we get a silent
+            # boot followed by a "broken simulator" report. The address
+            # matches the BCM2837 SoC peripheral mapping (Pi 3 base
+            # 0x3f000000 + PL011 offset 0x201000).
+            #
             # No `quiet`: surface kernel boot messages to ttyAMA0 so the
-            # user sees progress while the 5.4 GiB Pi OS rootfs comes up
-            # (~30-60 s wall on a QEMU-emulated Cortex-A53 quad). No
-            # `init=/bin/sh`: let systemd run normally so a real
-            # `serial-getty@ttyAMA0` lands the user at a login prompt
-            # instead of a silent non-interactive shell.
-            'console=ttyAMA0 root=/dev/mmcblk0p2 rootwait rw '
+            # user sees progress while the 5.4 GiB Pi OS rootfs comes up.
+            # No `init=/bin/sh`: let systemd run normally; the SD image
+            # ships with a serial-getty@ttyAMA0 autologin drop-in (baked
+            # by scripts/configure-pi3-autologin.sh) so the user lands
+            # at a root shell without credentials.
+            'earlycon=pl011,mmio32,0x3f201000 '
+            'console=ttyAMA0,115200 '
+            'root=/dev/mmcblk0p2 rootwait rw '
             'dwc_otg.lpm_enable=0',
         ]