feat: Phase 3 threshold keys, arch-audit dep, btrfs scrub timer

The thresholds TOML gains packages.keyring_warn_days, the [security] cve_min_warn floor, [systemd] expected_timers_extra, and two curation tables: kept_orphans (deliberate keeps the orphan count skips) and qkk_known (fnmatch paths for -Qkk mismatches that are config knowledge, like the resolver symlink and the pacman-contrib file this script edits itself).

The installer now pulls arch-audit (the console's CVE source) and enables btrfs-scrub@-.timer on btrfs installs. Ratio had the scrub timer enabled out-of-band, so a fresh install would have warned "missing" forever on the console's maintenance-timers check. The todo Phase 3 task closes as a dated log entry.

1 files changed, 31 insertions, 0 deletions

diff --git a/configs/maintenance-thresholds.toml b/configs/maintenance-thresholds.toml
index f729a01..898f47a 100644
--- a/configs/maintenance-thresholds.toml
+++ b/configs/maintenance-thresholds.toml
@@ -43,12 +43,23 @@ zfs_space_warn_pct = 20             # snapshot space vs pool capacity
 
 [packages]
 cache_warn_gb = 10                  # suggest paccache beyond the weekly keep-3
+keyring_warn_days = 60              # stale archlinux-keyring silently breaks updates
+
+[security]
+cve_min_warn = "high"               # arch-audit severity floor that warns (the
+                                    # constant Unknown/Low tail is background)
 
 [updates]
 pending_warn = 50                   # "a lot" — reddens the strip border
 cache_stale_hours = 6               # network-tier cache older than this warns
 topgrade_warn_days = 14             # topgrade freshness
 
+[systemd]
+# The capability-derived expected set (paccache/reflector always;
+# btrfs-scrub@ + snapper timers on btrfs; sanoid + zfs-scrub-weekly@ on ZFS)
+# lives in code — this list adds host-agnostic extras on top.
+expected_timers_extra = []
+
 [logs]
 app_log_warn_days = 7               # log-cleanup cron should hold ~7 days
 journal_digest_top = 10             # groups shown in the journal digest
@@ -91,3 +102,23 @@ entries = ["winvm"]
 [curation.pacnew_safe_delete]
 # Regenerated files whose .pacnew is safe to drop (reflector-managed / local).
 entries = ["/etc/pacman.d/mirrorlist", "/etc/locale.gen"]
+
+[curation.kept_orphans]
+# Packages pacman calls orphaned that are deliberate keeps (the rust lesson):
+# listed in evidence but never counted or warned on. KEEP/UNMARK levers write
+# the user layer; this shipped list stays empty.
+entries = []
+
+[curation.qkk_known]
+# pacman -Qkk mismatches that are config knowledge, not integrity findings
+# (fnmatch patterns). Unverifiable reads and mtime-only mismatches are
+# already excluded in code; this covers managed symlinks, regenerated
+# caches, and files archsetup itself edits.
+entries = [
+  "/etc/resolv.conf",                              # resolver-managed symlink
+  "/usr/lib/jvm/default",                          # archlinux-java symlinks
+  "/usr/lib/jvm/default-runtime",
+  "/usr/lib/ghc-*/lib/package.conf.d/package.cache", # regenerated by ghc-pkg
+  "/usr/lib/vlc/plugins/plugins.dat",              # regenerated plugin cache
+  "/etc/conf.d/pacman-contrib",                    # archsetup sets PACCACHE_ARGS
+]