feat(doctor): #77 hibernate/sleep section (VISION § C)

nomarchy-doctor gains a read-only hibernate/sleep section (the highest-ROI
Day-2 gap, a natural #76 follow-on): resume device on the kernel cmdline
(+ resume_offset for a swapfile), disk swap >= RAM, zram active, and any
suspend/hibernate error in the previous boot's kernel log. Self-gates
(skip on swap=0) and emits only ok/warn/skip, so it never fails the sheet.
Adds `hibernate` to the checks.doctor probe list so the row is asserted.

Fixes a set -euo pipefail hazard the first VM run caught (exit 1, no
verdict): a no-match grep inside $(...) and a `cond && action` both abort
under set -e — now guarded with || true / || echo 0 / if. Recorded in
MEMORY as a reusable gotcha for writeShellScriptBin scripts.

Verification: V2 PASS — checks.doctor VM test green (fresh build, exit 0;
asserts the hibernate row renders, healthy run stays 0). V1 — ran on real
LUKS+@swap hardware: all three ok rows render (resume set, swap 34G >= RAM,
zram 16G) and the sheet reaches its verdict. V0 bash -n + flake check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -332,6 +332,14 @@ Design/decision records and a running log of shipped work (items marked
   100 doesn't swallow it). The LUKS-initrd unlock + btrfs-swapfile
   `resume_offset` triple is a V3 laptop check (QEMU can't feed a boot-time
   offset for a file that only exists after first boot).
+  ✓ **Doctor hibernate/sleep section (#77, `VISION § C`):** `nomarchy-doctor`
+  gained a read-only hibernate row group — resume device on the cmdline
+  (+ `resume_offset` for a swapfile), disk swap ≥ RAM, zram active, and any
+  suspend/hibernate error in the previous boot's kernel log. Self-gates
+  (`skip` on `swap=0`); only `ok`/`warn`/`skip`, never fails the sheet. The
+  `checks.doctor` VM test asserts the `hibernate` row renders. (Gotcha
+  recorded: the script runs `set -euo pipefail`, so a no-match `grep` inside
+  `$(…)` or a `cond && action` aborts it — use `|| true` and `if`.)
 - ✓ **Hibernate double-unlock:** on resume from hibernate the LUKS
   passphrase already gates the machine, but locking hyprlock before sleep
   meant a second password. Fixed by *not locking* before an encrypted