test(hibernate): #76 slice 3 — V2 hibernate→resume VM check (PASS)

Add checks.hibernate: a runNixOSTest modeled on nixpkgs' hibernate.nix,
wired to the actual risk #76 introduces — coexistence with the zram swap
that oom.nix now enables by default. It imports oom.nix, puts the disk
swap at a lower priority than zram with an explicit boot.resumeDevice,
and uses systemd-initrd. The test drives a full
hibernate -> power-off -> resume -> crash cycle: a volatile ramfs marker
survives resume but NOT a crash-boot (proving genuine resume), and it
asserts zram sits at priority 100 while the disk swap is lower, so the
hibernate image lands on disk rather than volatile zram.

What QEMU genuinely can't do — feed a boot-time resume_offset for a btrfs
swapfile (offset only exists after first-boot allocation) or drive a
LUKS-initrd unlock — stays a V3 laptop check (HARDWARE-QUEUE, dev box
already runs that exact layout), plus the no-swap notify in a real
session. With this, all V0/V1/V2 work on #76 is done; #76 collapses to a
[blocked:hw] stub and the design record moves to ROADMAP.

Verification: V2 PASS — nix build .#checks.x86_64-linux.hibernate built
the driver fresh and exited 0. nix flake check --no-build green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -305,6 +305,24 @@ Design/decision records and a running log of shipped work (items marked
   logo/lock/bullet → text, entry/progress-box → surface, progress-bar →
   accent. Reads on light and dark; follows the theme as of the last system
   rebuild (like the background tint).
+- ✓ **Hibernation + zram by default (BACKLOG #76):** two memory layers ship
+  on by default. `modules/nixos/oom.nix` enables `zramSwap` (zstd, 50% RAM,
+  **priority 100**) as the compressed-RAM layer *before* earlyoom; the
+  installer defaults the disk swap to a **RAM-sized** hibernation-ready
+  swapfile on an `@swap` btrfs subvolume *inside* the encrypted volume, with
+  `patch-template.py` wiring `swapDevices` + `boot.resumeDevice` +
+  `resume_offset` (from `btrfs inspect-internal map-swapfile -r`). The
+  priority split is the point: day-to-day paging stays in zram, so the disk
+  swapfile is reserved for the hibernate image. `swapSize=0` stays a clean
+  no-swap opt-out; the Power-menu Hibernate row is kept unconditional and
+  **notifies on failure** (no-swap machines) rather than silently no-op'ing.
+  Existing machines get an *enable-hibernation* runbook in `docs/MIGRATION.md`
+  (no tool). Guarded by two VM checks — `checks.zram-swap` (device/algo/
+  priority) and `checks.hibernate` (a full hibernate→resume→crash cycle that
+  proves the image round-trips through disk swap and that zram at priority
+  100 doesn't swallow it). The LUKS-initrd unlock + btrfs-swapfile
+  `resume_offset` triple is a V3 laptop check (QEMU can't feed a boot-time
+  offset for a file that only exists after first boot).
 - ✓ **Hibernate double-unlock:** on resume from hibernate the LUKS
   passphrase already gates the machine, but locking hyprlock before sleep
   meant a second password. Fixed by *not locking* before an encrypted