Improve core/scripts:launch ergonomics

- Disable qemu monitor multiplexing. We don't need the monitor for most
  debugging tasks, and disabling it means we can kill the VM using Ctrl-C.

- Strip metacharacters and DOS newlines from qemu serial output.
  This makes logs easier to read in the CI, and prevents it from
  messing with terminal settings locally.

- Copy swtpm_data to a temporary directory to ensure we never override
  the build inputs (which can happen in a local run without sandbox).

  Re-running the target no longer triggers rebuilds for swtpm_data.

- Remove local tag from :launch - it works fine in the sandbox.

Test Plan:
Ran the test multiple times, no rebuilds occurred:

    bazel test core/scripts:test_boot

X-Origin-Diff: phab/D264
GitOrigin-RevId: 70d52e8a4cf24747d18fbaffeddb6e30bcdf61da
diff --git a/core/scripts/BUILD b/core/scripts/BUILD
index ce5e9a5..b03bc49 100644
--- a/core/scripts/BUILD
+++ b/core/scripts/BUILD
@@ -6,13 +6,13 @@
         "@//core:swtpm_data",
         "@edk2//:firmware",
     ],
-    tags = ["local"],
 )
 
 sh_test(
     name = "test_boot",
     size = "small",
     srcs = ["test_boot.sh"],
+    # expects wants a pty, which do not exist in the sandbox
     tags = ["local"],
     deps = [":launch"],
 )
diff --git a/core/scripts/launch.sh b/core/scripts/launch.sh
index 4aa2d9c..c375528 100755
--- a/core/scripts/launch.sh
+++ b/core/scripts/launch.sh
@@ -1,6 +1,12 @@
 #!/bin/sh
 
-swtpm socket --tpmstate dir=core/tpm --ctrl type=unixio,path=tpm-socket --tpm2 &
+TMP=$(mktemp -d)
+trap "{ rm -rf "$TMP"; pkill -9 -P $$; }" EXIT
+
+# sandbox uses a symlink farm - without -L, we would just copy the symlinks
+cp -Lr core/tpm/* "${TMP}"
+
+swtpm socket --tpmstate dir=${TMP} --ctrl type=unixio,path=tpm-socket --tpm2 &
 
 qemu-system-x86_64 \
     -cpu host -smp sockets=1,cpus=1,cores=2,threads=2,maxcpus=4 -m 1024 -machine q35 -enable-kvm -nographic -nodefaults \
@@ -16,4 +22,5 @@
     -global isa-debugcon.iobase=0x402 \
     -device ipmi-bmc-sim,id=ipmi0 \
     -device virtio-rng-pci \
-    -serial mon:stdio
+    -serial stdio \
+    | stdbuf -oL tr -d '\r' | cat -v