feat(suspend): re-enable suspend on s2idle, drop diagnostic scaffolding

Confirmed root cause: this hardware's S3 (deep) firmware path triggers a
fatal wake-from-suspend hang only on linux-hardened. INIT_ON_FREE + slab
hardening + tighter locking turn a latent driver race that stock linux
gets away with into an unrecoverable panic so early the journal isn't
even flushed. mem_sleep_default=s2idle bypasses the BIOS S3 path
entirely (s0ix is a pure-kernel low-power state) and suspends/resumes
reliably under hardened.

This is a widespread Lenovo S3 firmware issue across post-2018
ThinkPads (see Ubuntu T560, X1C9/10/11 reports). Lenovo themselves
moved newer firmwares to s2idle-only. Not a linux-hardened bug per se;
just hardened being a strict enough kernel to make the bug fatal.

Keep:
* mem_sleep_default=s2idle in etc/kernel/cmdline-linux-hardened.tmpl
  (only the hardened UKI; stock linux keeps unchanged shared cmdline)

Revert (all the diagnostic / speculative scaffolding from the last
few commits):
* MODULES=(intel_lpss_pci) → MODULES=()  — Arch wiki touchpad fix was
  not the cause here
* nmi_watchdog=panic softlockup_panic=1 panic=10 — only needed to
  auto-reboot during diagnosis
* no_console_suspend — diagnostic-only
* etc/systemd/logind.conf.d/20-no-suspend.conf  — masking workaround
* sleep-target masking block in run_onchange_after_deploy-etc.sh.tmpl,
  replaced with a one-shot cleanup that removes any leftover
  /dev/null symlinks from systems that ran the previous version
* systemd-pstore.service from systemd-units/system.txt — added only to
  catch the diagnostic panic
* diagnose-suspend.sh helper (and its .gitignore/.chezmoiignore entries)
* sway suspend → lock-session keybind workaround
* power-menu.sh Suspend entry restoration
* KEYBINDS.md docs

2 files changed, 8 insertions, 5 deletions

diff --git a/dot_config/sway/config b/dot_config/sway/config
index 817e7c4..48e5993 100644
--- a/dot_config/sway/config
+++ b/dot_config/sway/config
@@ -173,7 +173,7 @@ bindsym $mod+Ctrl+bracketleft exec ~/.config/sway/brightness-osd.sh down
 bindsym XF86AudioMicMute exec pactl set-source-mute @DEFAULT_SOURCE@ toggle
 bindsym XF86Bluetooth exec ~/.config/sway/bt-toggle.sh
 bindsym XF86ScreenSaver exec "playerctl -a pause; swaylock -f -e -c 000000"
-bindsym XF86Sleep exec loginctl lock-session
+bindsym XF86Sleep exec systemctl suspend
 bindsym XF86WLAN exec ~/.config/waybar/wifi-toggle.sh
 bindsym XF86RFKill exec rfkill toggle all
 
@@ -225,13 +225,13 @@ bindsym $mod+z mode "qr"
 
 # System / hardware submode — non-XF86 alternatives for the rarely used
 # hardware toggles and TUI launchers above. Enter with Super+x; mnemonic
-# letters (b=bluetooth, w=wifi, r=rfkill, s=lock-session, d=display,
+# letters (b=bluetooth, w=wifi, r=rfkill, s=sleep, d=display,
 # v=volume-mixer, k=keybinds, m=notification-picker).
 mode "system" {
     bindsym b exec ~/.config/sway/bt-toggle.sh, mode "default"
     bindsym w exec ~/.config/waybar/wifi-toggle.sh, mode "default"
     bindsym r exec rfkill toggle all, mode "default"
-    bindsym s exec loginctl lock-session, mode "default"
+    bindsym s exec systemctl suspend, mode "default"
     bindsym d exec ~/.config/sway/display-toggle.sh, mode "default"
     bindsym v exec $term --class=floating -e pulsemixer, mode "default"
     bindsym k exec $term --class=floating -e glow -p ~/dotfiles/KEYBINDS.md, mode "default"
diff --git a/dot_config/sway/executable_power-menu.sh b/dot_config/sway/executable_power-menu.sh
index 0a7de91..999259c 100644
--- a/dot_config/sway/executable_power-menu.sh
+++ b/dot_config/sway/executable_power-menu.sh
@@ -2,10 +2,9 @@
 # Keyboard-driven power menu via wofi --dmenu (j/k navigation).
 set -eu
 
-# Suspend entry intentionally omitted while suspend is disabled
-# system-wide. See etc/systemd/logind.conf.d/20-no-suspend.conf.
 choice=$(printf '%s\n' \
   "  Lock" \
+  "  Suspend" \
   "  Logout" \
   "  Reboot" \
   "  Poweroff" |
@@ -18,6 +17,10 @@ case "$choice" in
     playerctl -a pause
     exec swaylock -f -e -c 000000
     ;;
+  *Suspend)
+    playerctl -a pause
+    exec systemctl suspend
+    ;;
   *Logout) exec swaymsg exit ;;
   *Reboot) exec systemctl reboot ;;
   *Poweroff) exec systemctl poweroff ;;