fix(testing): cleanup traps, arg validation, and two real bugs

Two real bugs and a sweep of hygiene across the harness. `make test`
passed cleanly on this branch with the same 52/0/5 profile as the
2026-05-11 run, so the wiring is verified end-to-end.

Real bugs:

- `lib/vm-utils.sh` `snapshot_exists` was running
  `qemu-img snapshot -l | grep -q "$snapshot_name"`, which matches the
  name as a substring anywhere in the output — including inside dates
  or filenames in other fields. Replaced with an awk field extraction
  on the TAG column plus `grep -Fxq` for a whole-line literal match.
- `run-test-baremetal.sh` was setting `VALIDATION_PASSED=true|false`
  after validation, but `validation.sh` already uses
  `VALIDATION_PASSED` as a pass counter. The test report then
  referenced `$VALIDATION_PASSED_COUNT`, which is defined nowhere.
  Renamed the boolean to `TEST_PASSED` (matching run-test.sh's
  pattern) and report the actual counter.

Cleanup traps and arg validation:

- `run-test.sh` now installs a top-level EXIT trap that, on abort,
  kills QEMU and restores the clean-install snapshot. A
  `CLEANUP_DONE=1` sentinel keeps the existing normal-path cleanup
  from double-firing. This is the recurring pain from 2026-05-11
  where two failed runs left orphaned QEMU processes and dirty base
  disks behind.
- `create-base-vm.sh` and `debug-vm.sh` got the same kind of trap, plus
  `debug-vm.sh` now rejects non-`.qcow2` paths up front instead of
  letting QEMU fail later.
- `run-test.sh`, `run-test-baremetal.sh`, and `cleanup-tests.sh` now
  validate that options with required values actually receive one
  (`${var:?msg}` for `--script`/`--snapshot`/`--host`/`--password`,
  numeric check for `--keep`).
- `run-test-baremetal.sh` traps the temp git bundle for cleanup if the
  script aborts before its explicit `rm`. The ZFS rollback loop now
  uses `while IFS= read -r ds` and quotes `$ds` inside the ssh_cmd so
  dataset names with whitespace wouldn't break it.

Smaller hygiene:

- `vm-utils.sh` `check_ovmf` also checks `OVMF_VARS_TEMPLATE`; `start_qemu`
  validates disk and ISO paths before building the QEMU command;
  numeric tests quoted.
- `cleanup-tests.sh` find expression for temp disks wrapped in
  `\( ... -o ... \)`, all `while read` loops use `IFS= read -r`,
  orphaned QEMU cleanup tries SIGTERM with a 2s sleep before SIGKILL.
- `create-base-vm.sh` moved the "Copy an archangel-*.iso" info line
  before its `fatal` instead of after (unreachable), and added the
  serial-log path to the final summary.
- `lib/logging.sh` `stop_timer` no longer produces `$((end - ))` when
  the named timer was never started.
- `lib/network-diagnostics.sh` `read` → `IFS= read -r`.
- `setup-testing-env.sh` now installs all missing pacman packages in
  one transaction instead of one-at-a-time (avoids half-installed
  state if package N fails). KVM check also verifies the user has
  read+write on `/dev/kvm` and prints the `gpasswd -a $(id -un) kvm`
  fix if not.

A few items from the review I deliberately skipped: replacing the
codebase-wide unquoted `$SSH_OPTS` string with an array (cosmetic, would
need to be done everywhere at once), `set -e` adds where the existing
fall-through-on-failure is intentional, and a `--force` gate on
`create-base-vm.sh` (would break the expected workflow).

1 files changed, 23 insertions, 15 deletions

diff --git a/scripts/testing/run-test-baremetal.sh b/scripts/testing/run-test-baremetal.sh
index c108e6f..3beaefc 100755
--- a/scripts/testing/run-test-baremetal.sh
+++ b/scripts/testing/run-test-baremetal.sh
@@ -47,11 +47,11 @@ VALIDATE_ONLY=false
 while [[ $# -gt 0 ]]; do
     case $1 in
         --host)
-            TARGET_HOST="$2"
+            TARGET_HOST="${2:?--host requires a value}"
             shift 2
             ;;
         --password)
-            ROOT_PASSWORD="$2"
+            ROOT_PASSWORD="${2:?--password requires a value}"
             shift 2
             ;;
         --rollback-first)
@@ -86,6 +86,12 @@ fi
 TIMESTAMP=$(date +'%Y%m%d-%H%M%S')
 TEST_RESULTS_DIR="$PROJECT_ROOT/test-results/baremetal-$TIMESTAMP"
 ARCHZFS_INBOX="$HOME/code/archzfs/inbox"
+BUNDLE_FILE=""
+
+cleanup_baremetal() {
+    [ -n "$BUNDLE_FILE" ] && [ -f "$BUNDLE_FILE" ] && rm -f "$BUNDLE_FILE"
+}
+trap cleanup_baremetal EXIT
 
 # Override VM_IP for validation.sh ssh_cmd function
 VM_IP="$TARGET_HOST"
@@ -121,12 +127,13 @@ if $ROLLBACK_FIRST; then
     DATASETS=$(ssh_cmd "zfs list -H -o name -t snapshot | grep '@genesis$' | sed 's/@genesis$//'")
 
     step "Rolling back all datasets to genesis"
-    for ds in $DATASETS; do
+    while IFS= read -r ds; do
+        [ -z "$ds" ] && continue
         info "Rolling back $ds@genesis"
-        if ! ssh_cmd "zfs rollback -r $ds@genesis" &>> "$LOGFILE"; then
+        if ! ssh_cmd "zfs rollback -r \"$ds@genesis\"" &>> "$LOGFILE"; then
             warn "Failed to rollback $ds@genesis"
         fi
-    done
+    done <<< "$DATASETS"
     success "Rollback complete"
 
     # Need to reconnect after rollback
@@ -246,11 +253,11 @@ fi
 # Generate reports
 generate_issue_report "$TEST_RESULTS_DIR" "$ARCHZFS_INBOX"
 
-# Set validation result
-if [ $VALIDATION_FAILED -eq 0 ]; then
-    VALIDATION_PASSED=true
+# Set validation result (TEST_PASSED is the boolean; VALIDATION_PASSED stays the counter)
+if [ "$VALIDATION_FAILED" -eq 0 ]; then
+    TEST_PASSED=true
 else
-    VALIDATION_PASSED=false
+    TEST_PASSED=false
 fi
 
 # Generate test report
@@ -269,10 +276,10 @@ Test Method: Bare Metal ZFS
 
 Results:
   ArchSetup Exit Code: $ARCHSETUP_EXIT_CODE
-  Validation: $(if $VALIDATION_PASSED; then echo "PASSED"; else echo "FAILED"; fi)
+  Validation: $(if $TEST_PASSED; then echo "PASSED"; else echo "FAILED"; fi)
 
 Validation Summary:
-  Passed:   $VALIDATION_PASSED_COUNT
+  Passed:   $VALIDATION_PASSED
   Failed:   $VALIDATION_FAILED
   Warnings: $VALIDATION_WARNINGS
 
@@ -290,17 +297,18 @@ if $ROLLBACK_AFTER; then
     section "Rolling Back to Genesis (cleanup)"
 
     DATASETS=$(ssh_cmd "zfs list -H -o name -t snapshot | grep '@genesis$' | sed 's/@genesis$//'")
-    for ds in $DATASETS; do
+    while IFS= read -r ds; do
+        [ -z "$ds" ] && continue
         info "Rolling back $ds@genesis"
-        ssh_cmd "zfs rollback -r $ds@genesis" &>> "$LOGFILE" || true
-    done
+        ssh_cmd "zfs rollback -r \"$ds@genesis\"" &>> "$LOGFILE" || true
+    done <<< "$DATASETS"
     success "Rollback complete"
 fi
 
 # Final summary
 section "Test Complete"
 
-if [ $ARCHSETUP_EXIT_CODE -eq 0 ] && $VALIDATION_PASSED; then
+if [ "$ARCHSETUP_EXIT_CODE" -eq 0 ] && $TEST_PASSED; then
     success "TEST PASSED"
     exit 0
 else