[jrcruciani]

What changed

Item04 only. Reuse the existing locked NixOS VM harness and expose it once as checks.x86_64-linux.deadman; no runtime helper changes.

• Recover the running path, system profile and SSH after a prebuilt sshd-off test activation, requiring transient timer/service units to be collected.
• Prove the pin wins over a different boot default, and check warning-backed recovery for missing and invalid pins.
• Separately disarm and wait beyond the deadline plus systemd's default timer accuracy; a fresh journal cursor must show no rollback service entries.
• Reject a sequential second arm with its user-facing message, and retain concurrent-arm/pin preservation coverage.
• Update README coverage/test instructions, CI display names, and changelog section04 with actual evidence; retain sections01/02.

Evidence

Final HEAD: 4eb84978fc6adfa82d6436264b2074e95ee3d55d.

Final Linux/KVM run 35612136537 passed nix flake check --no-update-lock-file --print-build-logs against the unchanged locked NixOS 26.05 test input. The logs show the actual checks.x86_64-linux.deadman build and all seven subtests completing in a 272.05-second VM script, including the full 70-second disarm wait. This was an actual VM execution, not evaluation-only or a mocked check.

Initial run 35611400808 also passed at b955cefbfe9f88be039a813598085cacf2363424; the only subsequent codebase change records that evidence in the changelog. Embedded Python parsing and git diff --check passed locally. The worktree is clean.

No live-host timer tests, no bootloader coverage, no changes to runtime helpers, the lockfile, LICENSE, operational playbook/prompt, or CONTRIBUTING; no later-plan items. Optional profile-write-failure injection remains outside this change. Mergeable with passing CI, but intentionally left open and unmerged for the parent session's ordered upgrade coordination.