feat(doctor): read-only hardware health section (#44)

Six self-gating hardware checks in nomarchy-doctor, same ok/bad/warn/skip
+ one-fix-command contract: NetworkManager connectivity, default PipeWire
sink, VA-API/OpenGL smoke (only if vainfo/glxinfo present), fprintd unit +
enroll nudge, fwupd daemon + a soft warn when get-updates is non-empty,
and the laptop charge_control_end_threshold when a limit is set. Each
skips cleanly when its tool/service/device is absent, so the section
shrinks to the machine and never hard-fails on a missing feature.

Implemented by a worktree-isolated agent in parallel with the #46 install
VM; diff reviewed and cherry-picked here. Verified V0 (flake check) + V1
(nix build .#…pkgs.nomarchy-doctor — build-time bash -n + shellcheck),
re-run on main after cherry-pick; plus a read-only run on real hardware
(all six checks fired + self-gated). V2 (checks.doctor fakes) pending.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/JOURNAL.md

@@ -17,6 +17,25 @@ Template:
 
 ---
 
+## 2026-07-09 — #44 Doctor hardware section (delegated to worktree agent)
+- **Task:** NEXT #44 — read-only hardware checks in nomarchy-doctor
+  (HARDWARE.md §10). Delegated to a worktree-isolated opus agent so it ran
+  in parallel with the #46 install VM without KVM contention.
+- **Did:** Agent added six self-gating checks to `nomarchy-doctor.sh`
+  (NetworkManager, default PipeWire sink, VA-API/GL smoke, fprintd unit +
+  enroll nudge, fwupd active + get-updates warn, laptop charge-threshold),
+  each skipping cleanly when the tool/service/device is absent — same
+  ok/bad/warn/skip contract + one-fix-command style. Reviewed the diff and
+  cherry-picked onto main (branch `agent/doctor-hw-44`).
+- **Verified:** V0 flake check green; **V1** `nix build …pkgs.nomarchy-doctor`
+  (writeShellApplication runs bash -n + shellcheck at build) — re-run by me
+  on main after cherry-pick. Bonus: the agent ran the built binary on the
+  AMD dev box (read-only) — all six checks fired + self-gated correctly.
+- **Pending:** V2 — extend the `checks.doctor` nixosTest with fakes for the
+  new rows (VM; deferred while #46 held KVM). fwupd get-updates exit-code
+  semantics worth pinning in that fake.
+- **Next suggestion:** V2-verify #43+#44 together on the next VM pass.
+
 ## 2026-07-09 — #43 System ▸ Firmware fwupd menu (core shipped, V2 pending)
 - **Task:** NEXT #43 — surface fwupd/LVFS updates in the menu (VISION § A).
   Done while the VM was busy with #46, so V0/V1 only by design.