Restrict deadman and runtime-PM targets and add command timeouts

[timkpaine]

The dau-utils readiness review found two privileged-target defects and a set of fail-closed gaps. This is the whole set; nothing is left for a decision.

Deadman

• --unit is restricted to the tool's namespace (dau-deadman or dau-deadman-<suffix>); disarm --unit sshd planned to stop sshd.
• Every systemctl and systemd-run call runs sudo -n with a 15 s timeout. A missing command, a failed systemd-run, a hang, or a timer that did not come up after scheduling surfaces as DeadmanError; a query that cannot be answered counts as armed, as before.
• arm confirms the timer is active before reporting armed. status returns systemctl's exit code.
• The CLI uses subparsers, so disarm --timeout and status --dry-run are refused; dry-run output is shlex.joined and the disarm execution runs the same commands the dry run prints.

Runtime PM

• A device must be a PCI address (dddd:bb:dd.f). sysfs device entries are symlinks, so a resolved-path check cannot confine a write on a real host; the name is the confinement, and the docstring says so.
• --device and --pattern are mutually exclusive and one is required; --lspci-output without --pattern is refused.
• Every attribute in the plan is checked before the first write; a missing one refuses the whole plan. A pattern that matches nothing is still tolerated (the device being recovered may not enumerate) and now says so on stderr. lspci has a timeout and its absence names pciutils.
• RuntimePmWrite accepts only the four values the two knobs take.

dau-build's hardware plans call arm --timeout N, hold --device <bdf> and hold --pattern ... as separate commands; all three still compose.

Docs and gates

• README: requirements (systemd, sudo policy, sysrq, pciutils), installation from the repository, sudo on the runtime-PM examples, the armed() note (it disarms on an exception, which a hardware plan must not), the timeout labelled as policy, neutral patterns in place of the bench's; the PyPI badge and template note are gone.
• test_readme.py runs every documented command in its dry-run form; README changes run CI.
• Classifiers match CI; check-types is in make checks; the template test and the orphan coverage omit are deleted; the lspci fixture uses synthetic ids; the module docstring names no board.

[github-actions]

Test Results

39 tests  +14   39 ✅ +14   0s ⏱️ ±0s
 1 suites ± 0    0 💤 ± 0 
 1 files   ± 0    0 ❌ ± 0 

Results for commit c89eb03. ± Comparison against base commit 35945bc.

This pull request removes 6 and adds 20 tests. Note that renamed tests count towards both.

dau_utils.tests.test_all ‑ test_all
dau_utils.tests.test_deadman ‑ test_arm_schedules_when_no_timer_is_live
dau_utils.tests.test_deadman ‑ test_cli_arm_dry_run_prints_the_scheduled_reset_command
dau_utils.tests.test_pci_runtime_pm ‑ test_cli_missing_sysfs_paths_surface_skips_and_fail
dau_utils.tests.test_pci_runtime_pm ‑ test_cli_partial_apply_reports_skip_and_fails
dau_utils.tests.test_pci_runtime_pm ‑ test_cli_without_patterns_matches_no_devices

dau_utils.tests.test_deadman ‑ test_a_missing_or_hanging_systemd_is_a_deadman_error
dau_utils.tests.test_deadman ‑ test_arm_reports_an_unprotected_host_when_the_timer_does_not_come_up
dau_utils.tests.test_deadman ‑ test_arm_schedules_when_no_timer_is_live_and_confirms_it
dau_utils.tests.test_deadman ‑ test_cli_arm_dry_run_prints_the_scheduled_reset_command_shell_quoted
dau_utils.tests.test_deadman ‑ test_cli_refuses_flags_that_do_not_belong_to_the_action
dau_utils.tests.test_deadman ‑ test_cli_status_returns_systemctls_exit_code
dau_utils.tests.test_deadman ‑ test_units_outside_the_deadman_namespace_are_refused
dau_utils.tests.test_pci_runtime_pm ‑ test_a_device_that_is_not_a_pci_address_cannot_leave_the_sysfs_root
dau_utils.tests.test_pci_runtime_pm ‑ test_cli_missing_sysfs_paths_refuse_the_whole_plan
dau_utils.tests.test_pci_runtime_pm ‑ test_cli_refuses_an_ambiguous_or_empty_selection
…

[codecov]

Codecov Report

❌ Patch coverage is 95.22059% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.14%. Comparing base (35945bc) to head (c89eb03).

Files with missing lines	Patch %	Lines
dau_utils/deadman.py	87.50%	8 Missing ⚠️
dau_utils/pci_runtime_pm.py	91.93%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #64      +/-   ##
==========================================
+ Coverage   92.83%   94.14%   +1.30%     
==========================================
  Files           6        6              
  Lines         307      495     +188     
  Branches       25       39      +14     
==========================================
+ Hits          285      466     +181     
- Misses         18       26       +8     
+ Partials        4        3       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.