Let the contracts assert properties, not the machine they were written on

The first run of the suite on a laptop found five contracts asserting the
desktop instead of the code. settings-system pinned DP-2 at 4500x3000 in
XRGB2101010; it now asks Hyprland what is actually primary. ssh-keys hardcoded
id_ed25519; it now uses whichever key exists. switcher's live half stepped a
session with one window, which step() deliberately refuses. displays raced the
service's revert readback -- the compositor looks restored while verification
still holds busy, so an immediate apply was refused with its error already
cleared; the harness now exposes settled and the contract waits for it.

declared-dependencies gets an OPTIONAL list for docker: the aliases serve
machines that run Docker deliberately, Panama's runtime is rootless podman,
and a missing docker fails by naming the command, which is loud enough.

Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh

tests/quickshell/switcher-contract

@@ -73,7 +73,12 @@ grep -q 'WlrKeyboardFocus.None' "$window" \
 
 # ── Live ────────────────────────────────────────────────────────────────────
 
-if command -v qs >/dev/null 2>&1 && qs ipc call switcher cancel >/dev/null 2>&1; then
+# Stepping refuses to open with fewer than two windows (see step() in the
+# state service) -- that is designed behavior, not a failure, so a session
+# with one window skips the live half rather than failing against it.
+open_windows="$(hyprctl -j clients 2>/dev/null | jq length 2>/dev/null || echo 0)"
+if command -v qs >/dev/null 2>&1 && (( open_windows >= 2 )) \
+    && qs ipc call switcher cancel >/dev/null 2>&1; then
     qs ipc call switcher next >/dev/null 2>&1
     sleep 0.6
     mapped="$(hyprctl layers -j 2>/dev/null | grep -c 'qs-switcher' || true)"