feat(doctor): #77 hibernate/sleep section (VISION § C)

nomarchy-doctor gains a read-only hibernate/sleep section (the highest-ROI
Day-2 gap, a natural #76 follow-on): resume device on the kernel cmdline
(+ resume_offset for a swapfile), disk swap >= RAM, zram active, and any
suspend/hibernate error in the previous boot's kernel log. Self-gates
(skip on swap=0) and emits only ok/warn/skip, so it never fails the sheet.
Adds `hibernate` to the checks.doctor probe list so the row is asserted.

Fixes a set -euo pipefail hazard the first VM run caught (exit 1, no
verdict): a no-match grep inside $(...) and a `cond && action` both abort
under set -e — now guarded with || true / || echo 0 / if. Recorded in
MEMORY as a reusable gotcha for writeShellScriptBin scripts.

Verification: V2 PASS — checks.doctor VM test green (fresh build, exit 0;
asserts the hibernate row renders, healthy run stays 0). V1 — ran on real
LUKS+@swap hardware: all three ok rows render (resume set, swap 34G >= RAM,
zram 16G) and the sheet reaches its verdict. V0 bash -n + flake check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

flake.nix

@@ -428,7 +428,7 @@
               # sheet must still exit 0 — i.e. the section runs without
               # erroring under `set -euo pipefail`.
               healthy = machine.succeed("nomarchy-doctor 2>&1")
-              for probe in ["NetworkManager", "fingerprint", "fwupd", "VA-API"]:
+              for probe in ["NetworkManager", "fingerprint", "fwupd", "VA-API", "hibernate"]:
                   assert probe in healthy, f"doctor hardware section missing a self-gated '{probe}' row:\n{healthy}"
             '';
           };