feat(doctor): nomarchy-doctor — read-only health sheet + VM check (item 10)

The things that actually break user machines, one command (and menu ›
System › Doctor): failed system/user units, disk space (real
filesystems only — fstype allowlist makes it VM/live safe, device
dedupe collapses / and /nix), theme-state.json parses + is
git-tracked, flake dirty/behind as warnings, generation age (profile
symlink mtime — store paths are epoch-1), snapper timeline when
enabled. Read-only by contract; every ✖ prints the one fixing command;
exit 1 on any problem. Ships as pkgs/nomarchy-doctor so the VM check
runs on a minimal node.

Verified: V1 package build (shellcheck-gated) + a real-hardware smoke
that correctly flagged a genuinely failed user unit on the dev box;
V2 green — checks.doctor VM test: induced failed unit flips the sheet
to exit-1 naming the unit and its fix, reset-failed returns healthy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -83,6 +83,7 @@
           # works on machines that don't check out this repo.
           themesDir = ./themes;
         };
+        nomarchy-doctor = final.callPackage ./pkgs/nomarchy-doctor { };
       };
 
       nixosModules.nomarchy = {
@@ -183,6 +184,34 @@
                 touch $out
               '';
 
+          # nomarchy-doctor's contract: an induced failed unit flips the
+          # sheet to ✖/exit-1 and names the unit; with the failure
+          # cleared it reports healthy/exit-0. Minimal node (just the
+          # package) — the disk/flake/snapper checks self-skip in a VM.
+          doctor = pkgs.testers.runNixOSTest {
+            name = "nomarchy-doctor";
+            nodes.machine = { ... }: {
+              environment.systemPackages = [ pkgs.nomarchy-doctor ];
+              systemd.services.doomed = {
+                description = "deliberately failing unit (doctor test)";
+                serviceConfig = {
+                  Type = "oneshot";
+                  ExecStart = "${pkgs.coreutils}/bin/false";
+                };
+                wantedBy = [ "multi-user.target" ];
+              };
+            };
+            testScript = ''
+              machine.wait_for_unit("multi-user.target")
+              machine.wait_until_succeeds("systemctl is-failed doomed.service")
+              out = machine.fail("nomarchy-doctor 2>&1")
+              assert "doomed.service" in out, f"doctor did not name the failed unit:\n{out}"
+              assert "journalctl" in out, f"doctor did not print a fix:\n{out}"
+              machine.succeed("systemctl reset-failed")
+              machine.succeed("nomarchy-doctor")
+            '';
+          };
+
           # Config-level VM assertions for the nomarchy.hardware.* toggles —
           # what they SET (kernel cmdline, fprintd, PAM). Real hardware
           # behaviour (firmware/driver/device) needs bare metal and is out of