phase4/5: qemu TCG boot + ssh into VM

phase3: virtualization probe (app.py + model untouched)