feat(doctor): #147 — flag machine state the flake never set; linger is the worked example

/var/lib survives a migration untouched, and a stray pre-Nomarchy
Linger=yes marker shaped the QA box's session behavior for six months
with nothing in the flake to show for it. Ship the class as guards:

- nomarchy-doctor: new machine-state-drift check after the flake-checkout
  check — loginctl show-user -p Linger; "yes" warns (nothing is broken —
  it is drift) and prints the disable-linger fix; unknown-to-logind skips.
- docs/MIGRATION.md § Post-migration cleanup: "/var/lib machine state
  survives migration" — the worked example and the general suspicion rule.
- checks.doctor: linger sub-case — warn fires under enable-linger, exit
  stays 0, warning clears after disable-linger.

Deliberately NOT hardening the session wiring against the portal-gtk
restart race linger enabled: a clean install cannot reach that state.
The Waybar exec-once loose thread survives as BACKLOG #149.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.doctor green (both branches exercised).
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -493,6 +493,17 @@ Design/decision records and a running log of shipped work (items marked
   V2 by render, both heads + the password dialog, via the new
   `tools/plymouth-preview.sh`. V3 (a real docked boot/shutdown) is queued: the
   fake heads exist from the start, so the rig cannot resize a canvas.
+- ✓ **Machine state the flake can't see (#147, 2026-07-17):** the QA box ran
+  six months with `Linger=yes` from a pre-migration marker in
+  `/var/lib/systemd/linger` — set by nothing in the repo, visible to no flake
+  audit. The class ships as guards, not session hardening: `nomarchy-doctor`
+  now warns on linger drift (`loginctl show-user -p Linger` vs. the flake's
+  implicit "no", fix command printed), and MIGRATION.md § Post-migration
+  cleanup states plainly that `/var/lib` survives a migration and what to
+  sweep. The portal-gtk restart race that linger enabled was deliberately NOT
+  hardened against — a clean install cannot reach that state. V2:
+  `checks.doctor` grew a linger sub-case (warn fires, exit stays 0, clears
+  after `disable-linger`). The Waybar exec-once loose thread became #149.
 - ✓ **Dock mode survives a rebuild (#142, 2026-07-16):** Bernardo: every rebuild
   while docked re-lit the laptop panel and threw a workspace onto it, and he
   re-picked Dock mode by hand. It was not forgetfulness — **a rebuild performed