feat(doctor): nomarchy-doctor — read-only health sheet + VM check (item 10)

The things that actually break user machines, one command (and menu ›
System › Doctor): failed system/user units, disk space (real
filesystems only — fstype allowlist makes it VM/live safe, device
dedupe collapses / and /nix), theme-state.json parses + is
git-tracked, flake dirty/behind as warnings, generation age (profile
symlink mtime — store paths are epoch-1), snapper timeline when
enabled. Read-only by contract; every ✖ prints the one fixing command;
exit 1 on any problem. Ships as pkgs/nomarchy-doctor so the VM check
runs on a minimal node.

Verified: V1 package build (shellcheck-gated) + a real-hardware smoke
that correctly flagged a genuinely failed user unit on the dev box;
V2 green — checks.doctor VM test: induced failed unit flips the sheet
to exit-1 naming the unit and its fix, reset-failed returns healthy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/home/rofi.nix

@@ -434,6 +434,12 @@ ${themeRows}
           || { notify-send "Snapshots" "Snapshot tools unavailable (nomarchy.system.snapper off?)."; exit 0; }
         exec ${cfg.terminal} -e sudo nomarchy-snapshots ;;
 
+      doctor)
+        # Read-only health sheet in a terminal; exit code doesn't matter
+        # here — the sheet itself is the product.
+        exec ${cfg.terminal} -e sh -c "nomarchy-doctor
+          printf '\nEnter to close.'; read -r _" ;;
+
       rollback)
         # Undo, one menu away (informative + rock-stable). Desktop =
         # Home Manager generations: theme/config history is already one
@@ -528,6 +534,7 @@ ${themeRows}
           fi
           command -v nomarchy-snapshots >/dev/null 2>&1 && row "Snapshots" timeshift
           row "Rollback" edit-undo
+          command -v nomarchy-doctor >/dev/null 2>&1 && row "Doctor" utilities-system-monitor
           if [ -e "''${bats[0]}" ] && command -v powerprofilesctl >/dev/null 2>&1; then
             row "Power profile" preferences-system-power
           fi
@@ -547,6 +554,7 @@ ${themeRows}
           *"Auto-commit"*)    exec "$0" autocommit ;;
           *Snapshots*)        exec "$0" snapshot ;;
           *Rollback*)         exec "$0" rollback ;;
+          *Doctor*)           exec "$0" doctor ;;
           *"Power profile"*)  exec "$0" power-profile ;;
         esac ;;
 

modules/nixos/default.nix

@@ -293,6 +293,7 @@ in
     # ── Essential packages ───────────────────────────────────────────
     environment.systemPackages = with pkgs; [
       nomarchy-theme-sync # provided by overlays.default
+      nomarchy-doctor     # read-only health check (System › Doctor)
 
       # Friendly wrappers for the two rebuild paths (README §3). Run as
       # your user: `nix flake update` must NOT run as root (libgit2