fix: install BCM43602 resume kernel on affected Macs

[avillagran]

Summary

• detect the exact live-tested Apple BCM43602 hardware before elevation
• install linux-bcm43602 and its matching headers without removing stock Linux
• prefer the candidate in Limine while retaining stock Linux as a bootable fallback
• add a retryable migration for existing installations and include the packages in offline media

Depends on omacom/omarchy-pkgs#422.

Hardware scope

The integration runs only when all of these match:

• x86_64
• DMI vendor Apple Inc.
• product MacBookPro12,1
• Broadcom PCI device 14e4:43ba
• Apple PCI subsystem 106b:0133

The detector reads live system values through absolute command paths; environment variables cannot override the hardware identity.

Installation behavior

• checks /boot has at least 256 MiB available before changing the system
• installs linux-bcm43602 and linux-bcm43602-headers
• verifies that stock linux remains installed
• writes the Limine boot-order policy atomically
• regenerates boot images and verifies candidate and stock UKIs and Limine entries
• leaves complete systems unchanged on rerun
• retries incomplete package or boot setup through the migration
• requests a reboot only after post-install readiness succeeds

Live validation

Validated on the affected MacBookPro12,1 with real lid-close deep S3:

• stock 7.2.3-arch1-3 reproduced 11 firmware command timeouts and lost Wi-Fi
• final 7.2.3-arch1-1-bcm43602 booted with kernel taint 0
• one final S3 entry and exit completed successfully
• brcmfmac reloaded BCM43602 firmware after resume
• zero brcmf_msgbuf_query_dcmd timeouts, D3 failures, Oopses, or general protection faults
• Wi-Fi reassociated on 5 GHz; 5/5 Internet pings succeeded with 0% loss
• stock Linux remained installed and bootable throughout the A/B test

No sleep hook, post-resume service, module unload/reload, or external reset script was used.

Tests

• bash test/shell.d/apple-bcm43602-kernel-test.sh: 13/13 passed
• Bash syntax checks passed for every changed script
• bin/omarchy commands --check: 469 commands passed
• git diff --check: passed
• independent package and integration reviews: passed with no blocking security or logic findings

The repository-wide shell suite still has 14 baseline/environment-sensitive failures also present without this change; the new BCM43602 suite passes within that run.

[laihenyi]

Independent review (AI-assisted, Claude). Read the detector, the install leaf, the migration and the test; ran the QA set in an Ubuntu 24.04 arm64 container.

Overall

The shape matches the existing linux-t2 integration exactly (offline list entry, PCI/DMI-gated leaf in install/hardware/apple/, limine-entry-tool.d drop-in, migration that reruns the leaf through sudo bash as 1787052918.sh does), and the stock kernel is kept as a fallback. No blocking defects in the code.

Blocking dependency

omacom/omarchy-pkgs#422 is still open and held for review (four SKIP checksums on a 13k-line kernel package). Until linux-bcm43602 exists in the repo, omarchy-pkg-add in the leaf fails on the affected machine and the new install/omarchy-other.packages entries break the ISO's offline mirror build for every Mac. This probably wants defer until the package lands.

Things worth a maintainer decision

1. install/omarchy-other.packages now carries a second full kernel plus headers for one model (MacBookPro12,1). That is the same trade-off already made for linux-t2, so consistent, but it is ISO size for everyone.
2. The detector matches DMI product MacBookPro12,1 exactly. Other Macs with the same BCM43602 (14e4:43ba, Apple subsystem 106b:0133), for example MacBookPro11,4/11,5 and MacBookAir7,x, will never get the kernel even if they show the same resume bug. Given only 12,1 was live-tested that is a defensible choice, but a comment saying how to extend the allow-list would help the next reporter.
3. The leaf runs before fix-wifi-resume.sh in install/hardware/all.sh; that script is gated to aarch64 and 14e4:(4425|4433), so no overlap.

Nits

• install-bcm43602-kernel.sh ends with an empty line inside the function before the closing brace.
• shellcheck (warning level) flags rm -rf "$test_tmp/boot" "$test_tmp/etc" in the test (SC2115); "${test_tmp:?}" would silence it. CI passes at the configured severity, so cosmetic.

Local verification (Ubuntu 24.04 arm64 container)

• Syntax loop: pass
• bin/omarchy commands --check: 469 commands pass
• test/shell.d/apple-bcm43602-kernel-test.sh: 13/13 pass