Add Software Update, across packages, applications and firmware

Three sources that fail independently, so they are counted and applied
separately: a flatpak mirror being down says nothing about whether a
kernel security fix is waiting. Blending them into one number would hide
exactly the case that matters.

Checking costs about nine seconds, which is too long to spend every time
a page opens, so the page opens on the last result and says when it was
taken. A first visit with nothing cached goes and finds out rather than
showing a confident "up to date" it has no basis for.

Installing packages takes a snapshot first, named after what is about to
happen, so Snapshots shows "before 32 package updates" rather than a
timestamp. Best effort: a machine without snapper still updates, because
an update that refuses to run when a nicety fails would be worse than
one without a restore point.

Automatic updates cover applications only, through a Panama-owned user
timer running daily with a randomized delay. Packages still ask, and
dnf-automatic is reported as absent rather than offered, because
installing software is not a settings action.

Health gained a check, and that is where the bug was: it first returned
status "degraded", which is not in the doctor's vocabulary of ok,
warning, error and unconfigured. It was counted as nothing at all while
the summary still said healthy -- the same silent no-op this codebase
keeps relearning. A contract now asserts every status a check can return
is one the doctor counts, and the doctor's own contract knows about the
new check rather than failing on its arrival.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

setup/scripts/link-dotfiles

@@ -267,6 +267,29 @@ done
 # editor ends up owning screenshots and a video transcoder ends up owning MP3s.
 # Seeding only fills roles nobody has chosen for; an existing "Open With" choice
 # is always kept.
+# Panama's own systemd user units -- currently the Flatpak update timer, which
+# the Updates page switches on and off. Linked rather than copied so an edit in
+# the repository is the edit that runs.
+PANAMA_UNIT_DIR="$PANAMA_PATH/config/local/share/systemd/user"
+USER_UNIT_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/systemd/user"
+if [[ -d "$PANAMA_UNIT_DIR" ]]; then
+  mkdir -p "$USER_UNIT_DIR"
+  for unit_file in "$PANAMA_UNIT_DIR"/*; do
+    [[ -e "$unit_file" ]] || continue
+    unit_name="$(basename "$unit_file")"
+    unit_target="$USER_UNIT_DIR/$unit_name"
+    if [[ -L "$unit_target" ]]; then
+      rm "$unit_target"
+    elif [[ -e "$unit_target" ]]; then
+      log "Keeping existing unit at $unit_target"
+      continue
+    fi
+    ln -s "$unit_file" "$unit_target"
+    log "Linked $unit_name → $unit_target"
+  done
+  systemctl --user daemon-reload 2>/dev/null || true
+fi
+
 DEFAULT_APPS_HELPER="$PANAMA_PATH/config/dot/quickshell/scripts/panama-default-apps"
 if [[ -x "$DEFAULT_APPS_HELPER" ]] && command -v xdg-mime >/dev/null 2>&1; then
   update-desktop-database "$USER_APPLICATION_DIR" >/dev/null 2>&1 || true