feat(vm): close RHCOS coverage gaps — aarch64 boot + broader artifact matrix

[ErenAri]

Closes the two gaps called out on the RHCOS evidence matrix: aarch64 and a broader artifact set. Both done with real boots, plus two genuine executor fixes uncovered along the way.

Executor fixes (latent bugs for any aarch64 cloud-image profile)

1. aarch64 UEFI firmware. aarch64 virt has no built-in firmware (x86 has SeaBIOS), so the executor now supplies AAVMF as pflash — read-only CODE + a per-VM writable VARS copy — overridable via BPFCOMPAT_AARCH64_UEFI_CODE/_VARS. Without this an aarch64 guest never boots.
2. KVM only for same-arch guests. /dev/kvm on an x86_64 host can't run an aarch64 guest, so qemuMachineArgs now falls back to TCG when guest arch ≠ host arch instead of passing an invalid accel=kvm.

Broader artifacts — x86_64, 6 × 3, real boots

Artifact	exercises	4.14 (9.2)	4.16 (9.4)	4.18 (9.4)
simple-pass	baseline	✅	✅	✅
ringbuf-modern	tp + ring buffer (≥5.8)	✅ load+attach	✅	✅
perfbuf-fallback	tp + perf buffer	✅ load+attach	✅	✅
attach-warn	kprobe (missing symbol)	✅ load / attach warn	✅	✅
aegis	BPF-LSM (4 hooks) + tp	❌ rejected (CAPABILITY_FAILURE)	✅ load+attach 4/4	✅ 4/4
core-relocation-fail	CO-RE negative	❌ rejected	❌ rejected	❌ rejected

The LSM row is the headline: a real backport boundary — BPF-LSM is active in RHEL 9.4 but not 9.2, on the same 5.14 line. Version inference can't see that; a real boot does.

aarch64 — real cross-arch boot

RHCOS 4.16 aarch64 booted on this x86_64 host under TCG: kernel 5.14.0-427.50.1.el9_4.aarch64, ring-buffer load+attach 1/1 — exercising the cross-compiled aarch64 validator, EDK II (AAVMF) UEFI, Ignition over -fw_cfg, SSH as core. On a native ARM64 KVM host the same run uses hardware acceleration automatically.

Honest scoping (unchanged)

• aarch64 here ran under TCG (slow, but a genuine aarch64 kernel + real bpf()); native ARM64 KVM is the fast path.
• RHCOS stays opt-in (BPFCOMPAT_ENABLE_RHCOS) and out of the README "Distributions covered" table.
• Not in public CI (operator-supplied images); recorded reproducible run.

Tests / verify

• New firmware unit tests (pflash args + writable-vars staging).
• go build/vet, gofmt, env-docs-check, go test ./internal/... green.

Adds profile rhcos-4.16-arm64, matrices/rhcos-arm64.yaml, env vars in internal/envref + docs/env-reference.md; full data in docs/evidence-rhcos.md.

🤖 Generated with Claude Code