Cover BCM4388 in Wi-Fi resume and gate it on omarchy-hw-platform

[maralcbr]

Ticket 38 of the Apple Silicon convergence plan. Stacked on #514 (mac/13-hw-platform); retarget to quattro-upstream once that merges.

What changed

• omarchy-mac already owns the iwd backend (/usr/lib/NetworkManager/conf.d/20-omarchy-mac-wifi.conf) and the resume recovery; mx-mac's inline wifi_backend.conf write stays only on the frozen fork. omarchy-mac-setup-system and the recovery gate (lib/wifi-supported, the unit's ExecCondition) now ask omarchy-hw-platform directly. Setup exits on other platforms and fails when the detector fails, rather than reading a contradiction as "not a Mac".
• The legacy /etc/NetworkManager/conf.d/wifi_backend.conf still retires only as a regular file byte-identical to what mx-mac, Run Omarchy on Apple Silicon under Asahi Linux omarchy#9835 and omarchy-upgrade-to-quattro wrote. Edited copies and links stay and keep precedence. A changed .omarchy-mac-retired backup now stops setup with a message naming it instead of a bare exit 1.
• Recovery covers BCM4388 (14e4:4434, M2 Pro/Max), following fix(wifi): cover BCM4388 in Wi-Fi resume recovery #465 as triaged in docs: triage Apple Silicon fixes open against quattro #521. The recovery command is unchanged and does nothing when Wi-Fi returns within 12 s.
• Migration 1790327076 runs omarchy-setup-mac --system on Apple Silicon Macs with BCM4388, whose earlier setup skipped the chip. It stays pending if detection fails or the installed add-on predates this change, so the add-on pin carrying this commit has to publish with or before the runtime. packages/omarchy-mac/version is left at 0.1.0 for the release pin to decide.
• test/manual/wifi-resume-check.sh is the before/after check for the hardware criterion.

Bluetooth #498 and #380 are not included. #380 changes the generic omarchy-bluetooth-power, which is identical upstream, so it belongs on omacom/omarchy (next to omacom#12753). #498 is a separate Apple recovery (hci_bcm4377 rebind, BCM4378/BCM4387, upstream bug still open) with its own gate and hardware check; the M2 Max's BCM4388 Bluetooth can't qualify it. It fits a separate Bluetooth resume ticket built the same way in packages/omarchy-mac.

Testing

• packages/omarchy-mac/test/all passes as non-root in an aarch64 Arch container, with real systemctl --root for enablement. It covers the platform and chip matrix on fresh roots, detector failure, the exact legacy bytes retiring with a backup, four edited variants and a link surviving, the changed-backup stop, and BCM4378/4387/4388 recovery.
• The new test/shell.d/apple-wifi-bcm4388-migration-test.sh drives the migration and the real omarchy-migrate runner: it stays pending on an old add-on and completes after the update. Negative controls: the old gate and setup fail the new package tests; dropping the pending check or widening the chip gate fails the migration test.
• ./test/all as non-root in the same container with the CI package set shows the same failures as untouched mac/13-hw-platform (config, hermes-remove, snapper, system-sleep-ownership). snapshot-restore-test.sh also failed once; it fails 1 in 3 standalone runs there and is unrelated.
• The manual check passes 13 stubbed scenarios (healthy, reload then reconnect, no resume and its report, failed or missing recovery run, Wi-Fi down, traffic over Ethernet, generated/edited/linked legacy file).
• Not run on hardware. Read-only inspection of the M2 Max: BCM4388, iwd backend, and a wifi_backend.conf byte-identical to the retired file. Acceptance on the converged image (ticket 25): copy the script to /var/tmp, run before from a local session, close the lid for at least five minutes, wake, run after.

Second review: three rounds on the change fixed the migration's detection-failure path, a test gap and quoting. A separate pass on the reworked manual check fixed a silent failure path and two races after wake.