feat: add QEMU software emulation fallback for VM testing

VM creation failed with "Emulator does not support virt type 'kvm'"
in environments without /dev/kvm (nested VMs, CI, containers). This
makes ISO boot testing work everywhere by detecting KVM at runtime.

Changes:
- vm/template.xml: replace hardcoded type='kvm' and cpu
  mode='host-passthrough' with @DOMAIN_TYPE@ and @CPU_MODE@ placeholders
- run.sh vm_create(): detect /dev/kvm at runtime, use KVM +
  host-passthrough when available, fall back to QEMU + qemu64
  software emulation when not
- tests: 6 new tests covering placeholder existence, KVM detection,
  and substitution logic

This enables the ISO to be booted and serial output captured for
verification even without hardware virtualization support.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

tests/unit/secureboot_test.bats

@@ -275,6 +275,34 @@
     grep -q "vm_setup_swtpm" /workspace/run.sh
 }
 
+# =============================================================================
+# VM KVM/QEMU Acceleration Fallback
+# =============================================================================
+
+@test "VM template has domain type placeholder" {
+    grep -q '@DOMAIN_TYPE@' /workspace/vm/template.xml
+}
+
+@test "VM template has CPU mode placeholder" {
+    grep -q '@CPU_MODE@' /workspace/vm/template.xml
+}
+
+@test "run.sh detects KVM availability via /dev/kvm" {
+    grep -q '/dev/kvm' /workspace/run.sh
+}
+
+@test "run.sh substitutes domain type in VM XML" {
+    grep -q '@DOMAIN_TYPE@' /workspace/run.sh
+}
+
+@test "run.sh substitutes CPU mode in VM XML" {
+    grep -q '@CPU_MODE@' /workspace/run.sh
+}
+
+@test "run.sh defaults to QEMU emulation when KVM unavailable" {
+    grep -q 'qemu64' /workspace/run.sh
+}
+
 # =============================================================================
 # Output Verification
 # =============================================================================