kvm: the render node must open as the qemu user, not exist for root

The vgem build worked - 'vgem built and loaded' - and qemu still died
with 'egl: no drm render node available' on all four VM jobs. The
mechanism, reproduced locally byte-for-byte: an insmod'd node ships
0600 root:root (devtmpfs's default; the runner's udev rules do not
widen a faux-bus vgem), and the smoke's qemu runs as the runner user -
the workflow's smoke step has no sudo, by design, and the disks it
boots are its own files. qemu's node scan silently skips the EACCES
and reports no node; the action's ls check passed because ls does not
need to open anything.

The node is now chmod'd 666 - the same treatment the kvm rule below
gives /dev/kvm - and the gate is the qemu user's own access(3), so
the next failure, if any, is loud and specific. Validated locally in
the vgem-only namespace: an unprivileged qemu with a 0600 node dies
with the runner's exact error, the same qemu with 0666 gets past EGL
and proceeds to its next argument.

Author: Letdown2491

.github/actions/kvm/action.yml

@@ -61,9 +61,28 @@ runs:
                     && echo "   .. vgem built and loaded"
             fi
         fi
-        # Loud here rather than as a confusing qemu death minutes later.
-        ls /dev/dri/renderD* >/dev/null 2>&1 \
-            || { echo "no DRM render node: the guest's GL (virgl) cannot initialize"; exit 1; }
+        # A freshly insmod'd node ships 0600 root:root — devtmpfs's
+        # default, and the runner's udev rules do not widen it — while
+        # the smoke's qemu runs as this user, not root. An unopenable
+        # node is indistinguishable from no node to qemu's scan: it
+        # silently skips the EACCES and reports "no drm render node
+        # available" (measured: reproduced locally, byte-identical, on
+        # 2026-10-05). The /dev/kvm rule below is the same lesson.
+        sudo chmod 666 /dev/dri/renderD* 2>/dev/null || true
+        # The check is the qemu user's, not root's: ls sees a node root
+        # owns, open is what qemu needs.
+        node=""
+        for candidate in /dev/dri/renderD*; do
+            if [ -c "$candidate" ] && [ -r "$candidate" ] && [ -w "$candidate" ]; then
+                node=$candidate
+                break
+            fi
+        done
+        if [ -z "$node" ]; then
+            echo "no DRM render node the qemu user can open: the guest's GL (virgl) cannot initialize"
+            exit 1
+        fi
+        echo "   .. render node: $node"
 
         # /dev/kvm is present on a hosted runner and the CPU exposes svm;
         # the runner user is simply not in the kvm group, and that is the