feat(suspend): re-enable suspend on s2idle, drop diagnostic scaffolding

Confirmed root cause: this hardware's S3 (deep) firmware path triggers a
fatal wake-from-suspend hang only on linux-hardened. INIT_ON_FREE + slab
hardening + tighter locking turn a latent driver race that stock linux
gets away with into an unrecoverable panic so early the journal isn't
even flushed. mem_sleep_default=s2idle bypasses the BIOS S3 path
entirely (s0ix is a pure-kernel low-power state) and suspends/resumes
reliably under hardened.

This is a widespread Lenovo S3 firmware issue across post-2018
ThinkPads (see Ubuntu T560, X1C9/10/11 reports). Lenovo themselves
moved newer firmwares to s2idle-only. Not a linux-hardened bug per se;
just hardened being a strict enough kernel to make the bug fatal.

Keep:
* mem_sleep_default=s2idle in etc/kernel/cmdline-linux-hardened.tmpl
  (only the hardened UKI; stock linux keeps unchanged shared cmdline)

Revert (all the diagnostic / speculative scaffolding from the last
few commits):
* MODULES=(intel_lpss_pci) → MODULES=()  — Arch wiki touchpad fix was
  not the cause here
* nmi_watchdog=panic softlockup_panic=1 panic=10 — only needed to
  auto-reboot during diagnosis
* no_console_suspend — diagnostic-only
* etc/systemd/logind.conf.d/20-no-suspend.conf  — masking workaround
* sleep-target masking block in run_onchange_after_deploy-etc.sh.tmpl,
  replaced with a one-shot cleanup that removes any leftover
  /dev/null symlinks from systems that ran the previous version
* systemd-pstore.service from systemd-units/system.txt — added only to
  catch the diagnostic panic
* diagnose-suspend.sh helper (and its .gitignore/.chezmoiignore entries)
* sway suspend → lock-session keybind workaround
* power-menu.sh Suspend entry restoration
* KEYBINDS.md docs

1 files changed, 13 insertions, 13 deletions

diff --git a/KEYBINDS.md b/KEYBINDS.md
index 9040c2a..898c78c 100644
--- a/KEYBINDS.md
+++ b/KEYBINDS.md
@@ -326,7 +326,7 @@ Mod key: `Super` (Mod4). Only personal additions beyond sway defaults listed.
 | `XF86AudioMicMute`      | Mic mute toggle                                               |
 | `XF86Bluetooth`         | Bluetooth power toggle (bluetoothctl)                         |
 | `XF86ScreenSaver`       | Lock screen + pause media (same as Super+Shift+s)             |
-| `XF86Sleep`             | Lock session (suspend disabled — see logind drop-in)          |
+| `XF86Sleep`             | Suspend system (systemctl suspend)                            |
 | `XF86WLAN`              | Toggle Wi-Fi (rfkill)                                         |
 | `XF86RFKill`            | Toggle all radios (rfkill)                                    |
 | `Super+Shift+Return`    | Open ghostty with yazi (file manager)                         |
@@ -364,18 +364,18 @@ runs the action and exits the mode; `Escape` or `Return` exits without
 acting. Provides non-XF86 access to the rare hardware toggles and TUI
 launchers.
 
-| In `system` mode  | XF86 equivalent | Action                          |
-| ----------------- | --------------- | ------------------------------- |
-| `b`               | `XF86Bluetooth` | Bluetooth power toggle          |
-| `w`               | `XF86WLAN`      | Wi-Fi toggle (rfkill wifi)      |
-| `r`               | `XF86RFKill`    | Toggle all radios (rfkill)      |
-| `s`               | `XF86Sleep`     | Lock session (suspend disabled) |
-| `d`               | `XF86Display`   | Display mode toggle             |
-| `v`               | `XF86Tools`     | Floating pulsemixer             |
-| `k`               | `XF86Keyboard`  | Floating glow KEYBINDS.md       |
-| `m`               | `XF86Favorites` | Notification picker             |
-| `n`               | —               | Toggle Do-Not-Disturb (mako)    |
-| `Escape`/`Return` | —               | exit submode                    |
+| In `system` mode  | XF86 equivalent | Action                       |
+| ----------------- | --------------- | ---------------------------- |
+| `b`               | `XF86Bluetooth` | Bluetooth power toggle       |
+| `w`               | `XF86WLAN`      | Wi-Fi toggle (rfkill wifi)   |
+| `r`               | `XF86RFKill`    | Toggle all radios (rfkill)   |
+| `s`               | `XF86Sleep`     | Suspend (systemctl suspend)  |
+| `d`               | `XF86Display`   | Display mode toggle          |
+| `v`               | `XF86Tools`     | Floating pulsemixer          |
+| `k`               | `XF86Keyboard`  | Floating glow KEYBINDS.md    |
+| `m`               | `XF86Favorites` | Notification picker          |
+| `n`               | —               | Toggle Do-Not-Disturb (mako) |
+| `Escape`/`Return` | —               | exit submode                 |
 
 ## Typing / Input