Add Software Update, across packages, applications and firmware

Three sources that fail independently, so they are counted and applied
separately: a flatpak mirror being down says nothing about whether a
kernel security fix is waiting. Blending them into one number would hide
exactly the case that matters.

Checking costs about nine seconds, which is too long to spend every time
a page opens, so the page opens on the last result and says when it was
taken. A first visit with nothing cached goes and finds out rather than
showing a confident "up to date" it has no basis for.

Installing packages takes a snapshot first, named after what is about to
happen, so Snapshots shows "before 32 package updates" rather than a
timestamp. Best effort: a machine without snapper still updates, because
an update that refuses to run when a nicety fails would be worse than
one without a restore point.

Automatic updates cover applications only, through a Panama-owned user
timer running daily with a randomized delay. Packages still ask, and
dnf-automatic is reported as absent rather than offered, because
installing software is not a settings action.

Health gained a check, and that is where the bug was: it first returned
status "degraded", which is not in the doctor's vocabulary of ok,
warning, error and unconfigured. It was counted as nothing at all while
the summary still said healthy -- the same silent no-op this codebase
keeps relearning. A contract now asserts every status a check can return
is one the doctor counts, and the doctor's own contract knows about the
new check rather than failing on its arrival.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

docs/superpowers/plans/2026-08-19-settings-beyond-gnome.md

@@ -65,6 +65,28 @@ thing on this list and it is nearly free now.
 **Done when** the machine can be brought fully current from Settings, and going
 back is one click on a page that already exists.
 
+**Landed 2026-08-19.** All three sources, counted and applied separately.
+Firmware was added to the plan after the fact and belonged there: `fwupd` is
+installed, reports cleanly as JSON, and answers instantly.
+
+Two things the shape of the data forced. Checking costs about nine seconds, so
+the page opens on a cached result and says when it was taken -- a first visit
+with nothing cached goes and finds out rather than showing a confident "up to
+date" it has no basis for. And `dnf5` exits 100 when upgrades exist, which is
+success, not failure.
+
+Automatic updates apply to applications only, through a Panama-owned systemd
+user timer running daily with a randomized delay. Packages still ask.
+dnf-automatic is reported as absent rather than offered, because installing
+software is not a settings action.
+
+Health gained a check for it, which is where the interesting bug was: it first
+returned status "degraded", and the doctor's vocabulary is ok, warning, error,
+unconfigured. The check was counted as nothing at all while the summary still
+reported healthy -- the same silent no-op this codebase keeps relearning, this
+time caught by writing the contract. A contract now asserts every status a check
+can return is one the doctor counts.
+
 ---
 
 ## Batch 2 — Your infrastructure