feat(doctor): read-only hardware health section (#44)

Six self-gating hardware checks in nomarchy-doctor, same ok/bad/warn/skip
+ one-fix-command contract: NetworkManager connectivity, default PipeWire
sink, VA-API/OpenGL smoke (only if vainfo/glxinfo present), fprintd unit +
enroll nudge, fwupd daemon + a soft warn when get-updates is non-empty,
and the laptop charge_control_end_threshold when a limit is set. Each
skips cleanly when its tool/service/device is absent, so the section
shrinks to the machine and never hard-fails on a missing feature.

Implemented by a worktree-isolated agent in parallel with the #46 install
VM; diff reviewed and cherry-picked here. Verified V0 (flake check) + V1
(nix build .#…pkgs.nomarchy-doctor — build-time bash -n + shellcheck),
re-run on main after cherry-pick; plus a read-only run on real hardware
(all six checks fired + self-gated). V2 (checks.doctor fakes) pending.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -43,14 +43,14 @@ Core shipped 2026-07-09: self-gated **System ▸ Firmware** rofi row
    Waybar/updates-panel integration. (The doctor "updates available"
    check is item #44.) Spec: docs/HARDWARE.md §4.
 
-### 44. Doctor hardware section — read-only (`VISION § A`)
-Extend `nomarchy-doctor` with the same pass/fail + one-fix-command
-contract for: NetworkManager connectivity, default PipeWire sink,
-optional GPU smoke (`vainfo`/`glxinfo` if present), fprintd unit when
-fingerprint was enabled, fwupd active (+ warn if `get-updates`
-non-empty), laptop charge-threshold sysfs when a limit is set. Spec:
-docs/HARDWARE.md §10. Cost: doctor.sh sections; V1 in existing
-`checks.doctor` where fakes exist, rest V2/V3.
+### 44. Doctor hardware section — V2 checks.doctor extension
+Six read-only hardware checks shipped 2026-07-09 (NetworkManager,
+PipeWire sink, VA-API/GL smoke, fprintd, fwupd + get-updates warn,
+charge-threshold), all self-gating; V1 (doctor package builds:
+bash -n + shellcheck) + a real-hardware read-only smoke on the dev box.
+**Remaining V2:** extend the `checks.doctor` nixosTest with fakes to
+cover the new rows headlessly; pin the fwupd `get-updates` exit-code
+semantics (0 = updates) in that fake. Spec: docs/HARDWARE.md §10.
 
 ### 46. V2 verify: install swap=0 + unattended LUKS fail-closed (`208b8d4`)
 Pure `nix-instantiate` on disko subvols passed V0; **full install path