macOS: current Lilu/VirtualSMC/WhateverGreen/RestrictEvents, no isa-applesmc

The OSX-KVM ESP ships Lilu 1.6.8 / VirtualSMC 1.3.3 / WhateverGreen 1.6.7,
which disable themselves on macOS 26; Apple's SMC driver then runs on QEMU's
isa-applesmc stub and the restart path panics (SMCWDT smcWriteKey
kSMCBadCommand → nested panic after MACH Reboot). Overlay pinned current
releases (upstream.json opencore.kexts) and drop isa-applesmc: with the stub
present VirtualSMC steps aside ("multiple devices present"); alone it carries
the OSK and reboots work (PE restart test: 10 s, clean). RestrictEvents with
revpatch=memtab silences MacPro7,1's "Memory Modules Misconfigured".

- makeOpenCore: kext overlay + Kernel.Add entries for overlaid kexts,
  --memory-mb (4 DIMMs), bootArgs default revpatch=memtab
- qemu.nix: deviceArgsFor { appleSmc } (default false); cli: --applesmc for
  images built before this change
- vm-driver: reboot-death detection (reset 60 s after a guest reboot request
  that never comes back), panics wait for XNU's own auto-reboot, debug dir
  works across nixbld users
- generalize: QEMU USB keyboard declared ANSI (no Keyboard Setup Assistant)
- README: architecture, reliability handling, debugging

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XsESshRCoBoUVWV9qKURUF

lib/images/macos/README.md

@@ -98,3 +98,14 @@ AppleSMC with the OSK, XHCI keyboard/tablet, AHCI disks, VMware SVGA,
 virtio-net pinned to `PciRoot(0x0)/Pci(0x12,0x0)` so OpenCore marks it built-in
 (en0, required for Apple ID / iMessage). SMBIOS `MacPro7,1` with four DIMMs
 described (avoids the "Memory Modules Misconfigured" warning).
+
+OpenCore comes from OSX-KVM's proven ESP, with Lilu / VirtualSMC /
+WhateverGreen replaced by current releases (`upstream.json` → `opencore.kexts`):
+the versions OSX-KVM ships disable themselves on macOS 26, and without
+VirtualSMC the guest's restart path panics on QEMU's SMC stub
+(`SMCWDT smcWriteKey kSMCBadCommand`, nested panic after `MACH Reboot`).
+For the same reason QEMU's `isa-applesmc` is not used any more: its presence
+makes VirtualSMC step aside ("multiple devices present"); VirtualSMC carries
+the OSK itself. Images built before this change still need the stub:
+`vmix run --macos --applesmc`. RestrictEvents (`revpatch=memtab`) silences
+MacPro7,1's "Memory Modules Misconfigured" at login.