Validate physical controller input, reconnect, rumble, and speaker audio

[theos2node]

The VirtIO-serial controller and rumble protocol plus the AVAudioSession path are implemented, but physical end-to-end behavior is not yet accepted.

Acceptance:

• buttons, sticks, triggers, D-pad, reconnect, sleep/wake and foreground recovery pass;
• guest rumble drives the connected controller;
• guest playback reaches iPad speakers and recovers from interruption;
• no microphone/recording stream is exposed to the guest.