test(checks): #44 doctor hardware section — headless guard

Extend checks.doctor: the bare test VM lacks every probe tool, so the
healthy nomarchy-doctor run drives all six hardware checks in skip mode.
Assert the self-gated skip rows appear (NetworkManager, fingerprint,
fwupd, VA-API) and the sheet still exits 0 — proving the section runs
without erroring under set -euo pipefail. No node changes.

Verified V2: nix build .#checks.x86_64-linux.doctor passes. Closes #44.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

flake.nix

@@ -348,7 +348,14 @@
               assert "doomed.service" in out, f"doctor did not name the failed unit:\n{out}"
               assert "journalctl" in out, f"doctor did not print a fix:\n{out}"
               machine.succeed("systemctl reset-failed")
-              machine.succeed("nomarchy-doctor")
+              # The healthy run also exercises the #44 hardware section: in a
+              # bare VM every probe (nmcli/wpctl/vainfo/fprintd/fwupd) is
+              # absent, so each check must self-gate to a skip row and the
+              # sheet must still exit 0 — i.e. the section runs without
+              # erroring under `set -euo pipefail`.
+              healthy = machine.succeed("nomarchy-doctor 2>&1")
+              for probe in ["NetworkManager", "fingerprint", "fwupd", "VA-API"]:
+                  assert probe in healthy, f"doctor hardware section missing a self-gated '{probe}' row:\n{healthy}"
             '';
           };