feat(doctor): read-only hardware health section (#44)

Six self-gating hardware checks in nomarchy-doctor, same ok/bad/warn/skip
+ one-fix-command contract: NetworkManager connectivity, default PipeWire
sink, VA-API/OpenGL smoke (only if vainfo/glxinfo present), fprintd unit +
enroll nudge, fwupd daemon + a soft warn when get-updates is non-empty,
and the laptop charge_control_end_threshold when a limit is set. Each
skips cleanly when its tool/service/device is absent, so the section
shrinks to the machine and never hard-fails on a missing feature.

Implemented by a worktree-isolated agent in parallel with the #46 install
VM; diff reviewed and cherry-picked here. Verified V0 (flake check) + V1
(nix build .#…pkgs.nomarchy-doctor — build-time bash -n + shellcheck),
re-run on main after cherry-pick; plus a read-only run on real hardware
(all six checks fired + self-gated). V2 (checks.doctor fakes) pending.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -43,14 +43,14 @@ Core shipped 2026-07-09: self-gated **System ▸ Firmware** rofi row
    Waybar/updates-panel integration. (The doctor "updates available"
    check is item #44.) Spec: docs/HARDWARE.md §4.
 
-### 44. Doctor hardware section — read-only (`VISION § A`)
-Extend `nomarchy-doctor` with the same pass/fail + one-fix-command
-contract for: NetworkManager connectivity, default PipeWire sink,
-optional GPU smoke (`vainfo`/`glxinfo` if present), fprintd unit when
-fingerprint was enabled, fwupd active (+ warn if `get-updates`
-non-empty), laptop charge-threshold sysfs when a limit is set. Spec:
-docs/HARDWARE.md §10. Cost: doctor.sh sections; V1 in existing
-`checks.doctor` where fakes exist, rest V2/V3.
+### 44. Doctor hardware section — V2 checks.doctor extension
+Six read-only hardware checks shipped 2026-07-09 (NetworkManager,
+PipeWire sink, VA-API/GL smoke, fprintd, fwupd + get-updates warn,
+charge-threshold), all self-gating; V1 (doctor package builds:
+bash -n + shellcheck) + a real-hardware read-only smoke on the dev box.
+**Remaining V2:** extend the `checks.doctor` nixosTest with fakes to
+cover the new rows headlessly; pin the fwupd `get-updates` exit-code
+semantics (0 = updates) in that fake. Spec: docs/HARDWARE.md §10.
 
 ### 46. V2 verify: install swap=0 + unattended LUKS fail-closed (`208b8d4`)
 Pure `nix-instantiate` on disko subvols passed V0; **full install path

agent/JOURNAL.md

@@ -17,6 +17,25 @@ Template:
 
 ---
 
+## 2026-07-09 — #44 Doctor hardware section (delegated to worktree agent)
+- **Task:** NEXT #44 — read-only hardware checks in nomarchy-doctor
+  (HARDWARE.md §10). Delegated to a worktree-isolated opus agent so it ran
+  in parallel with the #46 install VM without KVM contention.
+- **Did:** Agent added six self-gating checks to `nomarchy-doctor.sh`
+  (NetworkManager, default PipeWire sink, VA-API/GL smoke, fprintd unit +
+  enroll nudge, fwupd active + get-updates warn, laptop charge-threshold),
+  each skipping cleanly when the tool/service/device is absent — same
+  ok/bad/warn/skip contract + one-fix-command style. Reviewed the diff and
+  cherry-picked onto main (branch `agent/doctor-hw-44`).
+- **Verified:** V0 flake check green; **V1** `nix build …pkgs.nomarchy-doctor`
+  (writeShellApplication runs bash -n + shellcheck at build) — re-run by me
+  on main after cherry-pick. Bonus: the agent ran the built binary on the
+  AMD dev box (read-only) — all six checks fired + self-gated correctly.
+- **Pending:** V2 — extend the `checks.doctor` nixosTest with fakes for the
+  new rows (VM; deferred while #46 held KVM). fwupd get-updates exit-code
+  semantics worth pinning in that fake.
+- **Next suggestion:** V2-verify #43+#44 together on the next VM pass.
+
 ## 2026-07-09 — #43 System ▸ Firmware fwupd menu (core shipped, V2 pending)
 - **Task:** NEXT #43 — surface fwupd/LVFS updates in the menu (VISION § A).
   Done while the VM was busy with #46, so V0/V1 only by design.