feat(doctor): nomarchy-doctor — read-only health sheet + VM check (item 10)

The things that actually break user machines, one command (and menu ›
System › Doctor): failed system/user units, disk space (real
filesystems only — fstype allowlist makes it VM/live safe, device
dedupe collapses / and /nix), theme-state.json parses + is
git-tracked, flake dirty/behind as warnings, generation age (profile
symlink mtime — store paths are epoch-1), snapper timeline when
enabled. Read-only by contract; every ✖ prints the one fixing command;
exit 1 on any problem. Ships as pkgs/nomarchy-doctor so the VM check
runs on a minimal node.

Verified: V1 package build (shellcheck-gated) + a real-hardware smoke
that correctly flagged a genuinely failed user unit on the dev box;
V2 green — checks.doctor VM test: induced failed unit flips the sheet
to exit-1 naming the unit and its fix, reset-failed returns healthy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -26,16 +26,6 @@ next, in what order*.
 
 ## NEXT
 
-### 10. `nomarchy-doctor` — one-shot health check
-New. A single command (+ System-menu entry) that checks the things that
-actually break user machines and prints a themed pass/fail sheet:
-failed systemd units (system + user), disk space (/, /boot, the nix
-store), state-file parses + is git-tracked, downstream flake dirty/
-diverged, last rebuild generation age, snapper timeline running (when
-enabled). Read-only, no auto-fixing; each failure prints the one command
-that fixes it. Optionally later: a self-gating Waybar warning fed by the
-same script. **Verify:** V2 — a VM check with an induced failure.
-
 ### 11. State-file validation & friendly errors
 New; "the user never has to master Nix" must include *error messages*.
 A hand-edited theme-state.json (trailing comma, wrong type, unknown
@@ -126,6 +116,9 @@ earns ≥3 entries — keep the root at six.
 - **MIPI/IPU software-ISP camera** support (no-UVC machines).
 - **OCR screenshot-to-text**: a Capture › entry (grim region → tesseract
   → clipboard) — cheap once recording (#12) reshapes the submenu.
+- **Doctor Waybar warning**: a self-gating bar indicator fed by
+  `nomarchy-doctor` (shipped 2026-07-04) — appears only when the sheet
+  has a ✖; click opens the sheet.
 - **Auto-timezone Waybar tooltip** showing the detected zone (optional).
 - **VPN exit-node richer display** (country/city) (optional).
 - **NixOS release bump → v2** `[human]`: deliberate, hand-edited, never