Let the contracts assert properties, not the machine they were written on

The first run of the suite on a laptop found five contracts asserting the
desktop instead of the code. settings-system pinned DP-2 at 4500x3000 in
XRGB2101010; it now asks Hyprland what is actually primary. ssh-keys hardcoded
id_ed25519; it now uses whichever key exists. switcher's live half stepped a
session with one window, which step() deliberately refuses. displays raced the
service's revert readback -- the compositor looks restored while verification
still holds busy, so an immediate apply was refused with its error already
cleared; the harness now exposes settled and the contract waits for it.

declared-dependencies gets an OPTIONAL list for docker: the aliases serve
machines that run Docker deliberately, Panama's runtime is rootless podman,
and a missing docker fails by naming the command, which is loud enough.

Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh

tests/quickshell/displays-contract

@@ -309,7 +309,10 @@ target_scale=$(awk -v s="$original_scale" 'BEGIN { print (s == 1.25) ? 1.5 : 1.2
 run ipc call displays-test revertChange >/dev/null
 immediate_reverted=false
 for _ in $(seq 1 60); do
-    if display_is_restored && [[ "$(status | jq -r .awaiting)" == "false" ]]; then
+    # settled, not awaiting: the compositor can look restored while the
+    # service's revert verification is still reading back, and an apply in
+    # that window is refused as busy. See the settled field in the harness.
+    if display_is_restored && [[ "$(status | jq -r .settled)" == "true" ]]; then
         immediate_reverted=true
         break
     fi
@@ -345,6 +348,11 @@ done
 [[ "$(status | jq -r .overridden)" == "false" ]] || fail 'an unconfirmed change was written to the settings store'
 
 # ── A confirmed change is what writes ────────────────────────────────────────
+# Wait out the revert readback before applying again -- same race as above.
+for _ in $(seq 1 40); do
+    [[ "$(status | jq -r .settled)" == "true" ]] && break
+    sleep 0.2
+done
 [[ "$(run ipc call displays-test applyScale "$target_scale")" == "true" ]] \
     || fail 'the confirmed-change fixture could not apply'