The harness grows a QMP channel (M21.0)

Every case now gets a -qmp unix socket (additive; no case notices). A
minimal client does the capabilities handshake and executes one command;
the per-case qmp_after hook sends it N seconds after boot, retrying until
the guest's socket is up. A case with a hook configured cannot pass until
the hook delivered — and the smoke case now carries a harmless
query-status hook, so the channel is proven end to end on every run.
This is how the power scenarios inject the real ACPI power-button event
(system_powerdown) in M21.1 and M21.3.

docs/m21-plan.md

@@ -70,11 +70,11 @@ auto-merge to main when the branch is green; keep the branch; push everything.
 
 ## Status
 
-- [ ] **M21.0** — baseline: rebase over anything newly merged (the dead-code
-      sweep touches acpi.zig); cut `feat/power-events`; add the QMP channel to
-      the harness (`-qmp unix:.../qmp.sock,server,nowait`, a small client with
-      the `qmp_capabilities` handshake, a per-case `qmp_after` hook that sends
-      a command N seconds after boot); existing suite stays green.
+- [x] **M21.0** — baseline (dead-code sweep confirmed landed on main — no
+      acpi.zig conflict; `feat/power-events` cut; QMP channel in the harness:
+      always-on unix socket, client with the capabilities handshake, per-case
+      `qmp_after` hook, and a hook-must-deliver pass gate that the smoke case
+      now proves with a harmless query-status; suite 58/58).
 - [ ] **M21.1** — SCI + the power button: kernel appends the FADT as an
       acpi-tables memory resource; new `power-protocol` module +
       `ServiceId.power`; the acpi service converts to the harness, registers