feat(doctor): read-only hardware health section (#44)

Six self-gating hardware checks in nomarchy-doctor, same ok/bad/warn/skip
+ one-fix-command contract: NetworkManager connectivity, default PipeWire
sink, VA-API/OpenGL smoke (only if vainfo/glxinfo present), fprintd unit +
enroll nudge, fwupd daemon + a soft warn when get-updates is non-empty,
and the laptop charge_control_end_threshold when a limit is set. Each
skips cleanly when its tool/service/device is absent, so the section
shrinks to the machine and never hard-fails on a missing feature.

Implemented by a worktree-isolated agent in parallel with the #46 install
VM; diff reviewed and cherry-picked here. Verified V0 (flake check) + V1
(nix build .#…pkgs.nomarchy-doctor — build-time bash -n + shellcheck),
re-run on main after cherry-pick; plus a read-only run on real hardware
(all six checks fired + self-gated). V2 (checks.doctor fakes) pending.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pkgs/nomarchy-doctor/nomarchy-doctor.sh

@@ -127,6 +127,129 @@ else
   skip "snapper (not enabled on this machine)"
 fi
 
+# ══ hardware ═════════════════════════════════════════════════════════
+# Every check below self-gates: it skips cleanly when the tool, service,
+# or device isn't present, so the section shrinks to fit the machine and
+# never fails just because a feature is absent. Still read-only.
+
+# ── network (NetworkManager) ─────────────────────────────────────────
+if command -v nmcli >/dev/null 2>&1; then
+  nmstate=$(nmcli -t -f STATE general status 2>/dev/null || true)
+  case "$nmstate" in
+    connected*) ok "NetworkManager: $nmstate" ;;
+    "")         skip "NetworkManager (no state reported)" ;;
+    *)          warn "NetworkManager state: $nmstate" \
+                     "connect in System › Network (or: nmcli device)" ;;
+  esac
+else
+  skip "NetworkManager (nmcli not present)"
+fi
+
+# ── default audio sink (PipeWire) ────────────────────────────────────
+# wpctl/pactl talk to the user's PipeWire session — only meaningful with
+# a user bus (not over bare SSH/root).
+if [ -n "$(systemctl --user is-system-running 2>/dev/null || true)" ]; then
+  if command -v wpctl >/dev/null 2>&1; then
+    if wpctl inspect @DEFAULT_AUDIO_SINK@ >/dev/null 2>&1; then
+      ok "default audio sink present"
+    else
+      warn "no default PipeWire sink" "pick one in System › Audio (or: wpctl status)"
+    fi
+  elif command -v pactl >/dev/null 2>&1; then
+    defsink=$(pactl get-default-sink 2>/dev/null || true)
+    if [ -n "$defsink" ] && [ "$defsink" != "@DEFAULT_SINK@" ]; then
+      ok "default audio sink: $defsink"
+    else
+      warn "no default audio sink" "pick one in System › Audio"
+    fi
+  else
+    skip "audio sink (no wpctl/pactl)"
+  fi
+else
+  skip "audio sink (no user session bus here)"
+fi
+
+# ── GPU acceleration smoke (only if the probes are installed) ────────
+if command -v vainfo >/dev/null 2>&1; then
+  if vainfo >/dev/null 2>&1; then
+    ok "VA-API acceleration works (vainfo)"
+  else
+    warn "vainfo present but VA-API probe failed" \
+         "check mkFlake.hardwareProfile / GPU drivers (or run: vainfo)"
+  fi
+else
+  skip "VA-API smoke (vainfo not installed)"
+fi
+if command -v glxinfo >/dev/null 2>&1; then
+  if [ -n "${WAYLAND_DISPLAY:-}${DISPLAY:-}" ]; then
+    if glxinfo -B >/dev/null 2>&1; then
+      ok "OpenGL renderer responds (glxinfo)"
+    else
+      warn "glxinfo present but GL probe failed" \
+           "check mkFlake.hardwareProfile / GPU drivers (or run: glxinfo -B)"
+    fi
+  else
+    skip "OpenGL smoke (no display attached)"
+  fi
+else
+  skip "OpenGL smoke (glxinfo not installed)"
+fi
+
+# ── fingerprint (only when fprintd is enabled) ───────────────────────
+if [ -n "$(systemctl list-unit-files fprintd.service --no-legend --plain 2>/dev/null || true)" ]; then
+  enrolled=""
+  if command -v fprintd-list >/dev/null 2>&1 && [ -n "${USER:-}" ]; then
+    enrolled=$(fprintd-list "$USER" 2>/dev/null || true)
+  fi
+  if [ -n "$enrolled" ] && ! printf '%s' "$enrolled" | grep -qi 'no fingers'; then
+    ok "fprintd enabled, fingerprint(s) enrolled for ${USER:-user}"
+  elif [ -n "$enrolled" ]; then
+    warn "fprintd enabled but no fingerprints enrolled" "enroll one: fprintd-enroll"
+  else
+    ok "fprintd unit installed (fingerprint enabled)"
+  fi
+else
+  skip "fingerprint (fprintd not enabled)"
+fi
+
+# ── firmware updates (fwupd) ─────────────────────────────────────────
+# fwupd is D-Bus-activated, so an idle daemon is normal, not a fault.
+# get-updates reads local metadata (no flashing); a hit is a soft warn.
+if command -v fwupdmgr >/dev/null 2>&1 \
+   && [ -n "$(systemctl list-unit-files fwupd.service --no-legend --plain 2>/dev/null || true)" ]; then
+  if systemctl is-active --quiet fwupd.service; then
+    ok "fwupd daemon active"
+  else
+    skip "fwupd daemon (idle — D-Bus-activated on demand)"
+  fi
+  if timeout 20 fwupdmgr get-updates >/dev/null 2>&1; then
+    warn "firmware updates are available" "review, then apply: fwupdmgr update"
+  else
+    ok "firmware up to date (no pending updates)"
+  fi
+else
+  skip "fwupd (not enabled / fwupdmgr absent)"
+fi
+
+# ── laptop battery charge threshold (only when a limit is set) ───────
+bat_seen=0; bat_limited=0
+for bat in /sys/class/power_supply/BAT*; do
+  f="$bat/charge_control_end_threshold"
+  [ -r "$f" ] || continue
+  bat_seen=1
+  lim=$(cat "$f" 2>/dev/null || true)
+  case "$lim" in
+    ''|*[!0-9]*) continue ;;
+  esac
+  if [ "$lim" -lt 100 ]; then
+    bat_limited=1
+    ok "$(basename "$bat") charge limit active at ${lim}%"
+  fi
+done
+if [ "$bat_seen" -eq 1 ] && [ "$bat_limited" -eq 0 ]; then
+  skip "battery charge limit (none set — charges to 100%)"
+fi
+
 # ── verdict ──────────────────────────────────────────────────────────
 echo
 if [ "$fails" -eq 0 ]; then