test(power): VM check for battery charge-limit udev re-apply

Add checks.battery-charge-limit (runNixOSTest): the test_power module
fakes a Mains adapter, toggling ac_online emits a real power_supply
uevent, and the test asserts the udev rule restarts the oneshot (changed
InvocationID). Verifies the re-apply *trigger* at runtime, beyond the
earlier eval check; the sysfs write still needs real hardware. Also
records the SSH_AUTH_SOCK rendered-artifact verification in the roadmap.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -298,9 +298,11 @@ how to override it. Items marked ✓ are shipped.
   shell's copy — resolved with `gpgconf --list-dirs agent-ssh-socket` at
   session-init (the same lookup the shell integration uses, so the two can't
   drift), reaching GUI apps via the login shell that starts Hyprland the same
-  way `NIXOS_OZONE_WL` does. Eval-verified (the var resolves to the gpgconf
-  substitution; home config builds). Pending an on-machine check that a GUI
-  git/ssh client picks up the agent.
+  way `NIXOS_OZONE_WL` does. Verified by building the home generation and
+  inspecting the rendered `hm-session-vars.sh` — it carries
+  `export SSH_AUTH_SOCK="$(…/gpgconf --list-dirs agent-ssh-socket)"` with the
+  command substitution intact (unescaped, resolved at session-init). Pending
+  an on-machine check that a GUI git/ssh client picks up the agent.
 - **Sanitize & organize the repo:** a housekeeping pass for consistency
   and clarity.
   - ✓ pruned now-redundant config: the installer no longer writes
@@ -361,10 +363,14 @@ how to override it. Items marked ✓ are shipped.
     unplug gap — the match is by adapter *type*, not kernel name
     (AC/AC0/ADP1/ACAD vary), and `restart` (not `try-restart`) re-applies
     even if the boot run was inactive. Eval-verified both ways (rule present
-    with charge limit on / absent off). **Pending an on-hardware check** (a
-    `sudo nixos-rebuild` + a physical unplug to fire the udev event — the
-    dev box has both an `AC` Mains adapter and a `BAT0`
-    `charge_control_end_threshold`, so it can exercise it).
+    with charge limit on / absent off), and **VM-verified the trigger**
+    (`checks.battery-charge-limit`: the `test_power` module fakes a Mains
+    adapter, toggling `ac_online` emits a real `power_supply` uevent, and the
+    udev rule restarts the oneshot — confirmed by a changed `InvocationID`).
+    The sysfs *write* itself needs a real `charge_control_end_threshold`, so
+    a final on-hardware check (a `sudo nixos-rebuild` + a physical unplug)
+    remains — the dev box has both an `AC` Mains adapter and a `BAT0`
+    `charge_control_end_threshold`, so it can exercise it.
   - ✓ **installer:** writes `power.laptop = true` (battery probe) and
     `power.thermal.enable` (Intel) into the generated `system.nix`.
   - ✓ **idle cohesion:** `modules/home/idle.nix` now suspends only on