test(archsetup): port full shell validation sweep to Testinfra (P2)

Port all ~26 post-install checks from validation.sh to pytest/Testinfra,
reaching parity before the cutover. Adds test_users, test_packages,
test_services, test_desktop, test_boot, test_keyring, and test_archsetup
(88 tests after parametrizing groups, services, timers, tools, and configs),
plus shared conftest fixtures for ZFS/NVMe/compositor/networking gating.

The shell sweep's three outcomes map cleanly: hard failures become assertions,
advisory warnings and unmet preconditions (headless compositor, slirp
networking, optional services, non-ZFS/non-NVMe hosts) become skips.

One correctness fix vs the shell sweep: check awww, not swww — archsetup
installs awww (swww's successor) and `pacman -Q swww` no longer matches.

Verified on the host: py_compile clean, pytest --collect-only green (88 tests).
The sweep against a real VM is verified by the make test run that follows.

1 files changed, 18 insertions, 2 deletions

diff --git a/scripts/testing/tests/test_users.py b/scripts/testing/tests/test_users.py
index 92ce768..c0097ed 100644
--- a/scripts/testing/tests/test_users.py
+++ b/scripts/testing/tests/test_users.py
@@ -1,12 +1,20 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 """Post-install checks: the user account archsetup creates.
 
-Parity port of validate_user_created / validate_user_shell from validation.sh.
+Parity port of validate_user_created / validate_user_shell / validate_user_groups.
 """
 
 import pytest
 
 
+# Groups archsetup adds: wheel (useradd -G), the usermod -aG set, and docker
+# (added later in the developer-workstation step).
+EXPECTED_GROUPS = [
+    "wheel", "sys", "adm", "network", "scanner", "power", "uucp",
+    "audio", "lp", "rfkill", "video", "storage", "optical", "users", "docker",
+]
+
+
 @pytest.mark.smoke
 @pytest.mark.attribution("archsetup")
 def test_user_exists(host, target_user):
@@ -15,4 +23,12 @@ def test_user_exists(host, target_user):
 
 @pytest.mark.attribution("archsetup")
 def test_user_shell_is_zsh(host, target_user):
-    assert host.user(target_user).shell == "/usr/bin/zsh"
+    # archsetup may set either path depending on how zsh resolves.
+    assert host.user(target_user).shell in ("/bin/zsh", "/usr/bin/zsh")
+
+
+@pytest.mark.attribution("archsetup")
+@pytest.mark.parametrize("group", EXPECTED_GROUPS)
+def test_user_in_group(host, target_user, group):
+    # Parametrized so a failure names the exact missing group.
+    assert group in host.user(target_user).groups