qr-onhw-smoke fails locally: silent exit after image load, before decode

[sidick]

make qr-onhw-smoke (the on-target datatypes.library QR-decode test,
tests/gui/qr-onhw.sh / tests/gui/qr_onhw.c) currently fails on this
machine — found while verifying #110 (vendored quirc update).

Symptom: serial output shows DATATYPES=yes then LOAD=0 W=86 H=86
(the image loaded fine via qrimage_load_gray), then nothing — no DEC=,
no URI=, no END. No visible crash: a manual boot with
--screenshot-after shows a normal 2.Workbench:> shell prompt, as if
qr-onhw exited (or was never entered) rather than hanging or Guru'ing.
Raising SECS just produces more DATATYPES=/LOAD= boot cycles (3 at
SECS=400), suggesting a reboot loop rather than a slow decode.

Ruled out:

• Not caused by the Update vendored quirc: fix memory-safety/UB bugs on malformed QR input #110 quirc update — A/B tested against the
  pre-update quirc (git stash the four changed files, rebuild, rerun):
  fails identically either way.
• Not the documented WB-HDD disk-degradation gotcha
  (.claude/skills/copperline-testing) — du -sh on AMIAUTH_WB_HDD shows
  ~51 MB, within the normal few-tens-of-MB range, not bloated.
• No CI baseline to compare against — qr-onhw-smoke isn't wired into
  .github/workflows/ci.yml at all; it's local-only tooling against a local
  Amiberry HDD/ROM fixture (tests/gui/.env). So this may be specific to
  this machine's current environment state rather than a real regression in
  the codebase — worth confirming on another machine/fresh clone before
  assuming it's a code bug.

To reproduce:
make qr-onhw-docker && make qr-onhw-smoke

Next steps to try:

• Confirm whether it reproduces on a fresh AMIAUTH_WB_HDD clone (rule out
  accumulated state in the long-lived local fixture).
• Check whether qr-onhw even reaches main() — a boot-time crash before
  the first DATATYPES= print would look identical to this from serial
  alone; try a screenshot earlier in the boot, or check if the binary even
  copies/executes (Startup-Sequence patching, SYS: assign timing).
• If it does reach main() and exits after LOAD=, the qrimage_free/the
  call into qr_decode_gray right after the LOAD= print is the next
  place to instrument.