Let the contracts assert properties, not the machine they were written on

The first run of the suite on a laptop found five contracts asserting the
desktop instead of the code. settings-system pinned DP-2 at 4500x3000 in
XRGB2101010; it now asks Hyprland what is actually primary. ssh-keys hardcoded
id_ed25519; it now uses whichever key exists. switcher's live half stepped a
session with one window, which step() deliberately refuses. displays raced the
service's revert readback -- the compositor looks restored while verification
still holds busy, so an immediate apply was refused with its error already
cleared; the harness now exposes settled and the contract waits for it.

declared-dependencies gets an OPTIONAL list for docker: the aliases serve
machines that run Docker deliberately, Panama's runtime is rootless podman,
and a missing docker fails by naming the command, which is loud enough.

Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh

tests/quickshell/ssh-keys-contract

@@ -96,9 +96,18 @@ grep -q 'durableRemoval' "$helper" \
 
 kind="$(printf '%s' "$state" | field "['agent'].get('kind','')")"
 if [[ "$kind" == "gnome-keyring" ]]; then
-    reason="$(printf '%s' "$("$helper" agent-remove "$HOME/.ssh/id_ed25519")" | field "['error']")"
-    [[ "$reason" == *"does not stick"* ]] \
-        || fail "removal against a keyring agent was not refused with its reason (got: $reason)"
+    # Whichever key this machine actually has. This used to hardcode
+    # id_ed25519, which asserted the author's machine: any other key name
+    # earned "That key no longer exists" instead of the refusal under test.
+    # No key at all means the property cannot be exercised here, not that it
+    # failed.
+    real_key="$(compgen -G "$HOME/.ssh/id_*.pub" | head -1)"
+    real_key="${real_key%.pub}"
+    if [[ -n "$real_key" ]]; then
+        reason="$(printf '%s' "$("$helper" agent-remove "$real_key")" | field "['error']")"
+        [[ "$reason" == *"does not stick"* ]] \
+            || fail "removal against a keyring agent was not refused with its reason (got: $reason)"
+    fi
     grep -q 'does not stick' "$page" \
         || fail 'the page does not say that removing a key from this agent has no effect'
 fi