fix(docking): make clamshell hotplug safe and discoverable

Real dock QA exposed pointer-bound menus, an absent default rescue watcher, the unsafe zero-output panel-off path, missing keyboard/audio hotplug coverage, and unpainted new outputs.

Route Rofi to the focused output; replace panel disable with safe workspace migration; always run and reconnect the display watcher and repaint hotplugged outputs; expose a default per-device keyboard picker; handle audio card availability transitions.

Verified: V1 — nix flake check --no-build; checks.docking-ux real Home Manager artifact build; option-docs/template-sot; Nix parse, py_compile, and git diff --check. V2 unavailable: no readable KVM. V3 pending in agent/HARDWARE-QUEUE.md.

flake.nix

@@ -779,6 +779,50 @@
             in
             assert ok; pkgs.runCommand "nomarchy-display-profiles" { } "touch $out";
 
+          # Docking artifact guard: default/no-profile Home Manager output
+          # must still launch both hotplug watchers, put Rofi on the focused
+          # monitor, expose the manual keyboard picker, and never ship the
+          # zero-output-prone "Laptop screen off" menu action again.
+          docking-ux =
+            let
+              hm = self.nixosConfigurations.nomarchy-live.config
+                .home-manager.users.${username};
+              gen = hm.home.activationPackage;
+              hyprconf = hm.xdg.configFile."hypr/hyprland.conf".source;
+              audio = toString hm.systemd.user.services.nomarchy-dock-audio.Service.ExecStart;
+            in
+            assert hm.programs.rofi.extraConfig.monitor == -1;
+            pkgs.runCommand "nomarchy-docking-ux"
+              { nativeBuildInputs = [ pkgs.bash pkgs.findutils pkgs.gnugrep ]; }
+              ''
+                set -euo pipefail
+                menu=$(find ${gen}/home-path/bin -name nomarchy-menu | head -1)
+                keyboard=$(find ${gen}/home-path/bin -name nomarchy-keyboard-layout | head -1)
+                watcher=$(find ${gen}/home-path/bin -name nomarchy-display-profile-watch | head -1)
+                test -n "$menu" -a -n "$keyboard" -a -n "$watcher"
+                bash -n "$menu"
+                bash -n "$keyboard"
+                bash -n "$watcher"
+                bash -n ${audio}
+                "$keyboard" layouts > layouts.txt
+                test "$(wc -l < layouts.txt)" -gt 50
+                grep -qx us layouts.txt
+                grep -qx gb layouts.txt
+                grep -qx pt layouts.txt
+                grep -q 'nomarchy-keyboard-watch' ${hyprconf}
+                grep -q 'nomarchy-menu keyboard' ${hyprconf}
+                grep -q 'nomarchy-display-profile-watch' ${hyprconf}
+                grep -q -- '--quiet wallpaper' "$watcher"
+                grep -q 'Dock mode' "$menu"
+                grep -q 'moveworkspacetomonitor' "$menu"
+                grep -q 'nomarchy-keyboard-layout' "$menu"
+                ! grep -q 'Laptop screen off' "$menu"
+                grep -q "'change':card" ${audio}
+                grep -q 'availability' ${audio}
+                echo "docking-ux: focused menu + safe display + keyboard/audio watchers present"
+                touch $out
+              '';
+
           # Night-light geo mode: with BOTH lat/long set the backing unit
           # flips hyprsunset → wlsunset (location-computed sunrise/sunset)
           # and the live-state ExecCondition gate survives the swap (the