Add Software Update, across packages, applications and firmware

Three sources that fail independently, so they are counted and applied
separately: a flatpak mirror being down says nothing about whether a
kernel security fix is waiting. Blending them into one number would hide
exactly the case that matters.

Checking costs about nine seconds, which is too long to spend every time
a page opens, so the page opens on the last result and says when it was
taken. A first visit with nothing cached goes and finds out rather than
showing a confident "up to date" it has no basis for.

Installing packages takes a snapshot first, named after what is about to
happen, so Snapshots shows "before 32 package updates" rather than a
timestamp. Best effort: a machine without snapper still updates, because
an update that refuses to run when a nicety fails would be worse than
one without a restore point.

Automatic updates cover applications only, through a Panama-owned user
timer running daily with a randomized delay. Packages still ask, and
dnf-automatic is reported as absent rather than offered, because
installing software is not a settings action.

Health gained a check, and that is where the bug was: it first returned
status "degraded", which is not in the doctor's vocabulary of ok,
warning, error and unconfigured. It was counted as nothing at all while
the summary still said healthy -- the same silent no-op this codebase
keeps relearning. A contract now asserts every status a check can return
is one the doctor counts, and the doctor's own contract knows about the
new check rather than failing on its arrival.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

config/dot/quickshell/scripts/panama-doctor

@@ -13,6 +13,7 @@ import re
 import secrets
 import signal
 import shutil
+import time
 import subprocess
 import sys
 from concurrent.futures import ThreadPoolExecutor
@@ -115,7 +116,7 @@ CHECK_ORDER = (
     "desktop.hyprpaper", "desktop.hypridle", "desktop.hyprlock", "desktop.vicinae", "input.pipewire",
     "input.clipboard", "input.wallpaper", "input.capture", "input.ocr", "input.brightness",
     "integration.nextcloud", "integration.rustdesk", "integration.kdeconnect", "integration.bluebubbles",
-    "integration.home-assistant", "integration.calendar", "panama.runtime-links", "panama.vicinae-commands",
+    "integration.home-assistant", "integration.calendar", "panama.updates", "panama.runtime-links", "panama.vicinae-commands",
     "panama.selected-terminal", "panama.selected-launcher", "panama.processes", "panama.caffeine",
 )
 
@@ -485,6 +486,61 @@ def check_calendar(config: DoctorConfig) -> Check:
     return Check("integration.calendar", "integrations", "Calendar", "ok", f"{enabled_sources} enabled calendar source{'s' if enabled_sources != 1 else ''} configured.")
 
 
+def check_updates(config: DoctorConfig) -> Check:
+    """Whether the machine is current, and whether it is running what it installed.
+
+    Two different questions with two different answers. A kernel that has been
+    installed but not booted into is the one people miss: everything reports
+    success, nothing looks wrong, and the security fix they installed last week
+    is sitting on disk unused. That is reported as its own state rather than
+    folded into "updates available".
+
+    Read from the Updates page's cache rather than by scanning: a health check
+    that took nine seconds of network work would make opening System Health feel
+    broken. A stale cache is reported as stale.
+    """
+    cache = Path(os.environ.get("XDG_CACHE_HOME", config.home / ".cache")) / "panama" / "updates.json"
+    running = os.uname().release
+
+    newest = running
+    rpm_query = run_command(("rpm", "-q", "kernel", "--qf", "%{VERSION}-%{RELEASE}.%{ARCH}\\n"), config)
+    if rpm_query.state == "ok":
+        installed = [line.strip() for line in rpm_query.stdout.splitlines() if line.strip()]
+        if installed:
+            newest = installed[-1]
+    if newest != running:
+        return Check("panama.updates", "panama-tools", "Software updates", "warning",
+                     f"A newer kernel is installed than the one running ({running} → {newest}). Restart to use it.",
+                     action=Action("open", "Open Software Update"))
+
+    try:
+        payload = json.loads(cache.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return Check("panama.updates", "panama-tools", "Software updates", "unconfigured",
+                     "Updates have not been checked yet.",
+                     action=Action("open", "Open Software Update"))
+
+    checked_at = int(payload.get("checkedAt", 0))
+    age_days = (time.time() - checked_at) / 86400 if checked_at else 999
+    security = int(payload.get("dnf", {}).get("securityCount", 0))
+    total = sum(int(payload.get(source, {}).get("count", 0))
+                for source in ("dnf", "flatpak", "firmware"))
+
+    if security > 0:
+        return Check("panama.updates", "panama-tools", "Software updates", "warning",
+                     f"{security} pending update{'' if security == 1 else 's'} carry a security advisory.",
+                     action=Action("open", "Open Software Update"))
+    if age_days > 7:
+        return Check("panama.updates", "panama-tools", "Software updates", "unconfigured",
+                     "Updates have not been checked in over a week.",
+                     action=Action("open", "Open Software Update"))
+    if total > 0:
+        return Check("panama.updates", "panama-tools", "Software updates", "ok",
+                     f"{total} update{'' if total == 1 else 's'} available, none carrying a security advisory.")
+    return Check("panama.updates", "panama-tools", "Software updates", "ok",
+                 "Everything is current.")
+
+
 def check_runtime_links(config: DoctorConfig) -> Check:
     def valid_link(name: str, relative_source: Path) -> bool:
         destination = config.config_home / name
@@ -601,7 +657,7 @@ def collect_checks(config: DoctorConfig) -> list[Check]:
         "desktop.hyprpaper": lambda: service_check("desktop.hyprpaper", "Hyprpaper", "hyprpaper", config, Action("repair", "Restart Hyprpaper")), "desktop.hypridle": lambda: service_check("desktop.hypridle", "Hypridle", "hypridle", config, Action("repair", "Restart Hypridle")), "desktop.hyprlock": lambda: check_hyprlock(config), "desktop.vicinae": lambda: service_check("desktop.vicinae", "Vicinae", "vicinae", config, Action("repair", "Restart Vicinae")), "input.pipewire": lambda: service_check("input.pipewire", "PipeWire", "pipewire", config),
         "input.clipboard": lambda: simple_ipc_check("input.clipboard", "Clipboard", "clipboard", config), "input.wallpaper": lambda: simple_ipc_check("input.wallpaper", "Wallpaper", "wallpaper", config), "input.capture": lambda: simple_ipc_check("input.capture", "Capture", "capture", config), "input.ocr": lambda: executable_check("input.ocr", "OCR", "tesseract", config), "input.brightness": lambda: check_brightness(config),
         "integration.nextcloud": lambda: check_nextcloud(config), "integration.rustdesk": lambda: check_rustdesk(config), "integration.kdeconnect": lambda: check_kdeconnect(config), "integration.bluebubbles": lambda: check_bluebubbles(config), "integration.home-assistant": lambda: check_home_assistant(config), "integration.calendar": lambda: check_calendar(config),
-        "panama.runtime-links": lambda: check_runtime_links(config), "panama.vicinae-commands": lambda: check_vicinae_commands(config), "panama.selected-terminal": lambda: executable_check("panama.selected-terminal", "Selected terminal", "kitty", config), "panama.selected-launcher": lambda: executable_check("panama.selected-launcher", "Selected launcher", "vicinae", config), "panama.processes": lambda: check_processes(config), "panama.caffeine": lambda: check_caffeine(config),
+        "panama.updates": lambda: check_updates(config), "panama.runtime-links": lambda: check_runtime_links(config), "panama.vicinae-commands": lambda: check_vicinae_commands(config), "panama.selected-terminal": lambda: executable_check("panama.selected-terminal", "Selected terminal", "kitty", config), "panama.selected-launcher": lambda: executable_check("panama.selected-launcher", "Selected launcher", "vicinae", config), "panama.processes": lambda: check_processes(config), "panama.caffeine": lambda: check_caffeine(config),
     }
     with ThreadPoolExecutor(max_workers=8) as executor:
         futures = {check_id: executor.submit(probes[check_id]) for check_id in CHECK_ORDER}