test(checks): pure-contract guards batch (#49)

Four new no-VM checks.* + CI py_compile expansion:
- hardware-db-modules: installer DB module names ∈ pinned
  nixos-hardware.nixosModules (a lock bump can rename a module and break
  profiled installs on just the matching DMI, invisible to any VM).
- installer-compose-lock: offline lock-composer contract on fixtures.
- installer-disko: pure Nix assert — swapSize "0"/"0G" → no @swap, "2G"
  → sized, withLuks wraps root (permanently guards the #46 install fix).
- windowrule-syntax: builds the generated hyprland.conf and fails on the
  pre-0.53 grammar / windowrulev2 keyword (guards ed7fd93).
CI py_compile now covers all tracked *.py; docs/TESTING.md §1 synced.

Implemented by a worktree agent; diff reviewed. Verified V0 (flake check)
+ V1 (each checks.x86_64-linux.* built on main, exit 0); agent's negative
tests confirm each guard fails on a regression.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/check.yml

@@ -61,12 +61,14 @@ jobs:
         # not run) and the downstream template through lib.mkFlake.
         run: nix flake check --no-build
 
-      - name: Python syntax (nomarchy-theme-sync)
-        # Via nix shell so the step doesn't depend on the runner image
-        # preinstalling python3.
+      - name: Python syntax (all tracked scripts)
+        # Every tracked *.py — theme-sync, the installer composers
+        # (compose-lock, patch-template) and the maintainer tools
+        # (tools/, tools/vm/). Via nix shell so the step doesn't depend on
+        # the runner image preinstalling python3.
         run: |
           nix shell nixpkgs#python3 --command \
-            python3 -m py_compile pkgs/nomarchy-theme-sync/nomarchy-theme-sync.py
+            bash -c 'git ls-files "*.py" | xargs -r python3 -m py_compile'
 
       - name: Shell syntax (tracked scripts)
         # The distro's user-facing scripts are generated by Nix (their