feat(doctor): nomarchy-doctor — read-only health sheet + VM check (item 10)

The things that actually break user machines, one command (and menu ›
System › Doctor): failed system/user units, disk space (real
filesystems only — fstype allowlist makes it VM/live safe, device
dedupe collapses / and /nix), theme-state.json parses + is
git-tracked, flake dirty/behind as warnings, generation age (profile
symlink mtime — store paths are epoch-1), snapper timeline when
enabled. Read-only by contract; every ✖ prints the one fixing command;
exit 1 on any problem. Ships as pkgs/nomarchy-doctor so the VM check
runs on a minimal node.

Verified: V1 package build (shellcheck-gated) + a real-hardware smoke
that correctly flagged a genuinely failed user unit on the dev box;
V2 green — checks.doctor VM test: induced failed unit flips the sheet
to exit-1 naming the unit and its fix, reset-failed returns healthy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/HARDWARE-QUEUE.md

@@ -86,6 +86,10 @@ QA machine), the **T14s** (webcam case).
       `sudo nomarchy-snapshots`, restore a single file (`undochange`)
       and walk a root-config rollback up to (or through) the
       typed-`yes` gate.
+- [ ] **Doctor (item 10)** — menu › System › Doctor opens the sheet in
+      a terminal; `nomarchy-doctor` over SSH shows the same minus user
+      units. On a healthy machine everything is ✔/– (dev-box run
+      2026-07-04 correctly flagged a genuinely failed user unit).
 - [ ] **Rollback menu (item 9b)** — after a couple of theme changes,
       menu › System › Rollback: recent desktop generations listed
       (newest marked current); picking an older one opens a terminal,