feat(audio,menu): dock audio auto-follow watcher + docked Display/Audio menu rows

Bernardo's dock test (the #87 V3): audio stayed on EasyEffects→speakers.
Root cause, established live: WirePlumber's stored default
(default-nodes state, written by any past explicit pick) outranks the
priority.session rules, so #87 alone can never move the default on a
real machine; EasyEffects 8 follows the default device (kcfg default
true, verified by watching its output links). Fix: nomarchy-dock-audio
(modules/home/dock-audio.nix, nomarchy.dockAudio.enable, default on) —
a pactl-subscribe watcher that set-default-sinks new dock-class sinks
(regex data imported from modules/nixos/dock-audio-rules.nix, single
source) with a toast, plus a startup sweep for login-while-docked that
never overrides a manual in-dock pick. Unplug falls back by priority.

Menus: Display gains docked rows — "Laptop screen off · everything →
<ext>" (live-only disable; a persisted one could black-screen an
undocked boot), "Screen on · <name>", "Move workspace · → next
monitor", "Swap workspaces" (exactly-2 gate); Audio gains a self-gated
"Send output → <dock sink>" quick row. All self-gate on real outputs.

Verified: V2-equivalent on live hardware (no dock available) — watcher
followed a fake dock-named null sink and fell back on unload, control
run without the watcher stayed pinned (proving the stored-default
diagnosis), EE output links moved mid-playback; generated menu bash -n
green, dock-row jq exercised on real pactl JSON, dispatchers probed on
live Hyprland; flake check + option-docs + template-sot green.
V3 pending: real-dock retest ×2 in HARDWARE-QUEUE (watcher keys on
new-sink events; pre-existing nodes that only flip route availability
would need the queued diagnosis data).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -402,6 +402,28 @@ Design/decision records and a running log of shipped work (items marked
   built-in. Rules in `modules/nixos/dock-audio-rules.nix`;
   `checks.dock-audio` pure + conf-file VM. Real hotplug V3 in
   HARDWARE-QUEUE.
+  ✓ **Dock audio round 2 — auto-follow watcher (2026-07-12):** the T14s
+  dock test showed priority rules alone can't deliver "just works":
+  WirePlumber's *stored* default (default-nodes state, written by any
+  past explicit device pick — every real machine has one) outranks
+  `priority.session`, so the default never moves on plug. Fix:
+  `nomarchy-dock-audio` (modules/home/dock-audio.nix,
+  `nomarchy.dockAudio.enable`, default on) — a `pactl subscribe` watcher
+  that `set-default-sink`s new dock-class sinks (regex data imported
+  from dock-audio-rules.nix, single source) + toasts; startup sweep for
+  login-while-docked (only when the default isn't already dock-class, so
+  restarts don't override a manual pick). EasyEffects needs nothing: EE 8
+  `useDefaultOutputDevice` defaults true and verified live — with a
+  stream playing, EE's output links moved to a fake dock-named null sink
+  and back on unload. Unplug = WirePlumber priority fallback to built-in.
+  Docked menu rows shipped alongside: Display gains "Laptop screen off ·
+  everything → <ext>" (live-only `keyword monitor <eDP>,disable` — a
+  persisted disable could black-screen an undocked boot), "Screen on ·
+  <name>", "Move workspace · → next monitor"
+  (`movecurrentworkspacetomonitor +1`), "Swap workspaces"
+  (`swapactiveworkspaces`, exactly-2 gate); Audio gains a self-gated
+  "Send output → <dock sink>" quick row (the watcher's manual override).
+  Real-dock V3 for both in HARDWARE-QUEUE.
   ✓ **neon-glass finish (#88, `VISION § D`):** rewrote whole-swap
   `rofi.rasi` to rofi-native `@color` glass panel (cyan rim, soft
   selection wash — same hex-alpha glass pattern as Boreal); btop title/