test(checks): pure-contract guards batch (#49)

Four new no-VM checks.* + CI py_compile expansion:
- hardware-db-modules: installer DB module names ∈ pinned
  nixos-hardware.nixosModules (a lock bump can rename a module and break
  profiled installs on just the matching DMI, invisible to any VM).
- installer-compose-lock: offline lock-composer contract on fixtures.
- installer-disko: pure Nix assert — swapSize "0"/"0G" → no @swap, "2G"
  → sized, withLuks wraps root (permanently guards the #46 install fix).
- windowrule-syntax: builds the generated hyprland.conf and fails on the
  pre-0.53 grammar / windowrulev2 keyword (guards ed7fd93).
CI py_compile now covers all tracked *.py; docs/TESTING.md §1 synced.

Implemented by a worktree agent; diff reviewed. Verified V0 (flake check)
+ V1 (each checks.x86_64-linux.* built on main, exit 0); agent's negative
tests confirm each guard fails on a regression.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -114,19 +114,6 @@ Next slice: on hardware, run `hyprctl clients` while each is open, read
 the real `class`, then append rules. Also revisit whether blueman/s-c-p
 actually float once seen (regex tolerance for the `.…-wrapped` form).
 
-### 49. Pure-contract `checks.*` batch — no VM (promoted 2026-07-09)
-Add pure runCommand checks (all V0):
-- Expand CI `py_compile` to **all** tracked `*.py` (compose-lock, tools/*,
-  tools/vm/*), not just theme-sync (`.gitea/workflows/check.yml`; sync
-  `docs/TESTING.md §1`).
-- Hardware-db module names ∈ pinned `nixos-hardware.nixosModules` (a lock bump
-  can rename modules and break profiled installs only on matching DMI).
-- Installer pure contracts: `compose-lock.py`, disko `swapSize`
-  ("0"/"0G"/"NG") + `withLuks` arg contract.
-- **windowrule dead-syntax guard:** build the generated `hyprland.conf` and
-  fail on the rule-first `windowrule = (float|center|size|tile|…) ,` pattern
-  or the `windowrulev2` keyword (would have caught `ed7fd93`).
-
 ### 50. Small code one-liners batch — V0/V1 (promoted 2026-07-09)
 - Bluetooth menu row self-gate on `command -v blueman-manager` (`rofi.nix`) —
   no-op when `nomarchy.system.bluetooth.enable = false`, like Printers.