feat(doctor): #147 — flag machine state the flake never set; linger is the worked example

/var/lib survives a migration untouched, and a stray pre-Nomarchy
Linger=yes marker shaped the QA box's session behavior for six months
with nothing in the flake to show for it. Ship the class as guards:

- nomarchy-doctor: new machine-state-drift check after the flake-checkout
  check — loginctl show-user -p Linger; "yes" warns (nothing is broken —
  it is drift) and prints the disable-linger fix; unknown-to-logind skips.
- docs/MIGRATION.md § Post-migration cleanup: "/var/lib machine state
  survives migration" — the worked example and the general suspicion rule.
- checks.doctor: linger sub-case — warn fires under enable-linger, exit
  stays 0, warning clears after disable-linger.

Deliberately NOT hardening the session wiring against the portal-gtk
restart race linger enabled: a clean install cannot reach that state.
The Waybar exec-once loose thread survives as BACKLOG #149.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.doctor green (both branches exercised).
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -1017,6 +1017,18 @@
               healthy = machine.succeed("nomarchy-doctor 2>&1")
               for probe in ["NetworkManager", "fingerprint", "fwupd", "VA-API", "hibernate", "battery health"]:
                   assert probe in healthy, f"doctor hardware section missing a self-gated '{probe}' row:\n{healthy}"
+              # Machine-state drift: linger (#147's worked example) — the
+              # flake never sets it, so a "yes" here is drift; doctor must
+              # warn (exit 0), not fail, and the warning must clear once the
+              # marker is gone.
+              machine.succeed("loginctl enable-linger root")
+              linger_on = machine.succeed("nomarchy-doctor 2>&1")
+              assert "Nomarchy never sets it" in linger_on, f"doctor did not flag linger drift:\n{linger_on}"
+              machine.succeed("loginctl disable-linger root")
+              linger_off = machine.succeed("nomarchy-doctor 2>&1")
+              assert "Nomarchy never sets it" not in linger_off, (
+                  f"doctor still flags linger drift after disable-linger:\n{linger_off}"
+              )
               # #80 battery health: faked sysfs (test_power has no cycle/design).
               machine.succeed(
                   "mkdir -p /tmp/fake-ps/BAT0 && "