test(checks): pure-contract guards batch (#49)

Four new no-VM checks.* + CI py_compile expansion:
- hardware-db-modules: installer DB module names ∈ pinned
  nixos-hardware.nixosModules (a lock bump can rename a module and break
  profiled installs on just the matching DMI, invisible to any VM).
- installer-compose-lock: offline lock-composer contract on fixtures.
- installer-disko: pure Nix assert — swapSize "0"/"0G" → no @swap, "2G"
  → sized, withLuks wraps root (permanently guards the #46 install fix).
- windowrule-syntax: builds the generated hyprland.conf and fails on the
  pre-0.53 grammar / windowrulev2 keyword (guards ed7fd93).
CI py_compile now covers all tracked *.py; docs/TESTING.md §1 synced.

Implemented by a worktree agent; diff reviewed. Verified V0 (flake check)
+ V1 (each checks.x86_64-linux.* built on main, exit 0); agent's negative
tests confirm each guard fails on a regression.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/JOURNAL.md

@@ -17,6 +17,24 @@ Template:
 
 ---
 
+## 2026-07-09 — #49 pure-contract checks.* batch (delegated, worktree)
+- **Task:** NEXT #49 — add pure (no-VM) `checks.*` guards. Delegated to a
+  worktree opus agent, parallel with #46 VM + the #47/#48 agent.
+- **Did:** Four new checks wired into `flake.nix` + CI py_compile expansion:
+  `hardware-db-modules` (installer DB module names ∈ pinned
+  nixos-hardware.nixosModules), `installer-compose-lock` (offline composer
+  contract on fixtures), `installer-disko` (pure Nix assert: swapSize
+  "0"/"0G" → no @swap, "2G" → sized, withLuks wrapping — permanently guards
+  the #46 fix), `windowrule-syntax` (builds the generated hyprland.conf, fails
+  on pre-0.53 grammar / windowrulev2 — permanently guards `ed7fd93`). CI
+  py_compile now covers all tracked `*.py`; TESTING.md §1 synced.
+- **Verified:** V0 flake check green; **V1** I built each of the four
+  `checks.x86_64-linux.*` on main after cherry-pick — all exit 0. Agent's
+  negative tests confirmed each guard FAILS on a deliberate regression.
+- **Pending:** none — all pure/headless, no VM. (A KVM CI runner, item 20,
+  would later run these + the VM suite on push.)
+- **Next suggestion:** #50 one-liners (mine); then close #46 (variant A boot).
+
 ## 2026-07-09 — #47+#48 docs/string factual-drift pass (delegated, worktree)
 - **Task:** NEXT #47 (docs + string drift) + #48 (i2c option-docs). Delegated
   to a worktree sonnet agent, parallel with #46 VM + the #49 agent, no shared