And obviously I forgot to fix the tests :)

Phew that linter is very conservative!

Looks good and was pretty easy to review thanks to how the commits were split.

Only nit is around those marshal/unmarshal and temporary config type in the scriptlet package.
I think it'd be better to them be part of the cfg package, but if that's impractical, then they should at least mention qemu in their name so someone looking at what's in the scriptlet package doesn't get confused.

but if that's impractical

It’s not, but the values marshalConf give and unmarshalConf take are a bit… wonky.
I’m not a huge fan of map[string]any values wandering through code for anything other than serialization. Here, any means either string or []string, which are very different to type-assert and deal with.
Also I don’t see why anyone would use these functions anywhere else when we have nicely typed structs.

they should at least mention qemu in their name

qemuMarshalConf, marshalQemuConf, or marshalQEMUConf? I prefer the 3rd.

qemuMarshalConf, marshalQemuConf, or marshalQEMUConf? I prefer the 3rd.

Yeah, 3rd is fine with me.