feat(hardware): xe-aware GuC, class-based NPU detect, latestKernel + VM test

Harden the hardware-enablement broad seed for newer hardware:

- xe vs i915: intel.guc emits the i915 param (i915.enable_guc=3), which the
  newer `xe` driver (Lunar Lake / Battlemage / Panther Lake, recent Xe GPUs)
  ignores — it enables GuC by default. hardware-db.sh now reads the in-use
  GPU driver (lspci -k) and writes `intel.guc = false` on xe hardware, so the
  toggle isn't a misleading no-op there.

- NPU detection by PCI accelerator class [1200] (+ keywords), attributing the
  vendor, instead of a fixed device-ID list — so new NPUs (e.g. Panther Lake)
  are caught without a code change. Known IDs kept as a fallback/reference.

- Kernel awareness: a nomarchy.hardware.latestKernel escape hatch
  (linuxPackages_latest) for very-new hardware whose drivers only just landed,
  and a build-time warning when npu.enable predates the shipped kernel
  (amdxdna needs 6.14+, intel_vpu wants recent). Downstream default is 6.18,
  which already carries amd-pstate + amdxdna; the reference host pins latest.

- VM test (checks.hardware-toggles, pkgs.testers.runNixOSTest): boots a
  minimal VM with the toggles on and asserts the config landed — amd_pstate
  + i915.enable_guc in /proc/cmdline, fprintd.service present, pam_fprintd in
  /etc/pam.d/sudo. Passing. (Hardware behaviour still needs bare metal.)

Docs: README + template note latestKernel; ROADMAP records the hardening.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pkgs/nomarchy-install/hardware-db.sh

@@ -149,6 +149,13 @@ nomarchy_detect_hw() {
     if [[ "$cpu_vendor" == "GenuineIntel" || $intelgpu -eq 1 ]]; then
         echo "NOMARCHY hardware.intel.enable=true"
         echo "DETAIL nomarchy.hardware.intel: GuC/HuC on; GPU-compute runtime opt-in"
+        # i915.enable_guc applies to the i915 driver only. The newer `xe` driver
+        # (Lunar Lake / Battlemage / Panther Lake, recent Xe GPUs) enables GuC by
+        # default and ignores the param — so turn the toggle off when xe is bound.
+        if lspci -k 2>/dev/null | grep -qiE 'driver in use: xe\b'; then
+            echo "NOMARCHY hardware.intel.guc=false"
+            echo "DETAIL Intel GPU on the xe driver → GuC default-on (i915 param skipped)"
+        fi
     fi
     if [[ "$cpu_vendor" == "AuthenticAMD" || $amdgpu -eq 1 ]]; then
         echo "NOMARCHY hardware.amd.enable=true"
@@ -177,16 +184,22 @@ nomarchy_detect_hw() {
         echo "DETAIL fingerprint reader detected → fprintd (PAM login/sudo opt-in)"
     fi
 
-    # NPU (detect-only → a commented, experimental opt-in). Intel VPU /
-    # AMD XDNA PCI IDs; best-effort across recent gens.
+    # NPU (detect-only → a commented, experimental opt-in). Match the PCI
+    # "Processing accelerators" class [1200] (or accelerator keywords) and
+    # attribute by vendor — future-proof vs a per-device-ID list, so new gens
+    # (e.g. Panther Lake) are caught without a code change. Known IDs kept for
+    # reference: Intel VPU 8086:{7d1d,643e,ad1d,b03e}, AMD XDNA 1022:1502.
     if command -v lspci >/dev/null 2>&1; then
-        if lspci -nn 2>/dev/null | grep -qiE '\[8086:(7d1d|643e|ad1d|b03e)\]'; then
-            echo "NOMARCHY-NPU intel"
-            echo "DETAIL Intel NPU detected (opt-in, experimental)"
-        elif lspci -nn 2>/dev/null | grep -qiE '\[1022:1502\]'; then
-            echo "NOMARCHY-NPU amd"
-            echo "DETAIL AMD XDNA NPU detected (opt-in, experimental)"
-        fi
+        local npu_line
+        npu_line=$(lspci -nn 2>/dev/null \
+            | grep -iE '\[1200\]|processing accelerat|neural|\[8086:(7d1d|643e|ad1d|b03e)\]|\[1022:1502\]' \
+            | head -1)
+        case "$npu_line" in
+            *"[8086:"*|*Intel*)
+                echo "NOMARCHY-NPU intel"; echo "DETAIL Intel NPU detected (opt-in, experimental)" ;;
+            *"[1022:"*|*"Advanced Micro Devices"*|*AMD*)
+                echo "NOMARCHY-NPU amd";   echo "DETAIL AMD XDNA NPU detected (opt-in, experimental)" ;;
+        esac
     fi
 
     # Chassis (glob test, not compgen — nixpkgs' non-interactive bash

pkgs/nomarchy-install/nomarchy-install.sh

@@ -437,11 +437,12 @@ fi
 # experimental opt-ins written commented for the user to flip on.
 HARDWARE_CONFIG=""
 if [[ ${#HW_NOMARCHY[@]} -gt 0 || -n "$NPU_VENDOR" ]]; then
-    has_intel=0; has_amd=0; has_fp=0
+    has_intel=0; has_amd=0; has_fp=0; intel_guc_off=0
     if [[ ${#HW_NOMARCHY[@]} -gt 0 ]]; then
         for nm in "${HW_NOMARCHY[@]}"; do
             case "$nm" in
                 hardware.intel.enable=true)       has_intel=1 ;;
+                hardware.intel.guc=false)         intel_guc_off=1 ;;
                 hardware.amd.enable=true)         has_amd=1 ;;
                 hardware.fingerprint.enable=true) has_fp=1 ;;
             esac
@@ -451,7 +452,12 @@ if [[ ${#HW_NOMARCHY[@]} -gt 0 || -n "$NPU_VENDOR" ]]; then
   # the heavier opt-ins are commented — uncomment to turn them on."
     if [[ $has_intel -eq 1 ]]; then
         hw_lines+="
-  nomarchy.hardware.intel.enable = true;            # GuC/HuC firmware (i915.enable_guc=3)
+  nomarchy.hardware.intel.enable = true;            # GuC/HuC firmware (i915.enable_guc=3)"
+        if [[ $intel_guc_off -eq 1 ]]; then
+            hw_lines+="
+  nomarchy.hardware.intel.guc = false;              # GPU on the xe driver → GuC is default-on"
+        fi
+        hw_lines+="
   # nomarchy.hardware.intel.computeRuntime = true;  # OpenCL/oneVPL GPU compute (opt-in)"
     fi
     if [[ $has_amd -eq 1 ]]; then
@@ -467,7 +473,8 @@ if [[ ${#HW_NOMARCHY[@]} -gt 0 || -n "$NPU_VENDOR" ]]; then
     fi
     if [[ -n "$NPU_VENDOR" ]]; then
         hw_lines+="
-  # nomarchy.hardware.npu.enable = true;            # $NPU_VENDOR NPU driver (experimental; userspace runtime BYO)"
+  # nomarchy.hardware.npu.enable = true;            # $NPU_VENDOR NPU driver (experimental; userspace runtime BYO)
+  # nomarchy.hardware.latestKernel = true;          # newest kernel if the NPU driver isn't in the shipped one"
     fi
     HARDWARE_CONFIG=$(cat <<NIX