ci(smoke): cover teardown, state transitions and fake hardware

The smoke test only exercised steady-state rendering and killed waybar with
SIGTERM, so whole crash classes were invisible: exit-time use-after-free
(#5182), module state transitions (#5183) and hardware-backed modules (#5179).
Add tiers that hit those paths under ASan (+ _GLIBCXX_ASSERTIONS):

- lib.sh: assert_clean_exit (SIGINT teardown -> checks segfault/abort + ASan
  report emitted during destruction), output hotplug helpers, signal/reload,
  WAYBAR_WRAP hook, opt-in leak detection.
- lifecycle.sh (gating): clean exit, runtime output hotplug (Bar/module
  destroy), toggle/reload churn, fast-interval teardown race (#5182 class).
- fuzz.sh (gating): pathological custom-backend output (empty, nonzero exit,
  invalid JSON, huge, non-UTF8, empty format).
- coverage.sh (gating): every Factory module must be classified for smoke
  coverage; a new unlisted module fails the job (#5179 slipped through).
- modules.sh: also render the whole matrix inside a group; SIGINT teardown per
  module instead of SIGTERM.
- state.sh (best-effort): real mpd driven through an empty queue (#5183) +
  stop/clear; pulseaudio + slider on a null sink.
- hardware.sh (best-effort): backlight, backlight/slider (#5179) and battery
  via umockdev.
- leakcheck.sh (report-only): clean-exit run under LSan.

test/smoke/coverage.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Tier — coverage tripwire. Every module the Factory can build must be classified
+# below: either smoke-tested headless (SAFE), or explicitly parked as needing real
+# hardware/a daemon (HARDWARE, best-effort in state.sh / hardware.sh) or a specific
+# compositor (COMPOSITOR). A newly added module that isn't listed fails this job,
+# forcing a conscious "is it covered?" decision instead of silently escaping the
+# smoke net -- which is how the slider/backlight crash class (#5179) slipped by.
+#
+# Usage: coverage.sh
+set -euo pipefail
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$DIR/../.." && pwd)"
+FACTORY_SRC="$ROOT/src/factory.cpp"
+
+mapfile -t FACTORY < <(grep -oE 'ref == "[^"]+"' "$FACTORY_SRC" | sed -E 's/.*"(.*)"/\1/' | sort -u)
+[ "${#FACTORY[@]}" -gt 0 ] || { echo "::error::could not parse module names from $FACTORY_SRC"; exit 1; }
+
+# Rendered headless with no hardware/daemon/compositor dependency.
+SAFE=(clock cpu cpu_usage cpu_graph cpu_frequency load memory disk
+      idle_inhibitor image user inhibitor)
+
+# Need real hardware or a system daemon; covered best-effort by hardware.sh / state.sh.
+HARDWARE=(backlight backlight/slider battery upower power-profiles-daemon bluetooth
+          network wwan gps pulseaudio pulseaudio/slider wireplumber jack sndio cava
+          mpd mpris temperature keyboard-state systemd-failed-units privacy tray gamemode)
+
+# Need a specific compositor / its IPC to produce output.
+COMPOSITOR=(sway/language sway/mode sway/scratchpad sway/window sway/workspaces
+            hyprland/language hyprland/submap hyprland/window hyprland/windowcount hyprland/workspaces
+            river/layout river/mode river/tags river/window
+            niri/language niri/window niri/workspaces
+            dwl/tags dwl/window
+            mango/keymode mango/language mango/layout mango/window mango/workspaces
+            wayfire/window wayfire/workspaces ext/workspaces wlr/taskbar)
+
+declare -A known=()
+for m in "${SAFE[@]}" "${HARDWARE[@]}" "${COMPOSITOR[@]}"; do known["$m"]=1; done
+
+missing=()
+for m in "${FACTORY[@]}"; do [ -n "${known[$m]:-}" ] || missing+=("$m"); done
+
+if [ "${#missing[@]}" -gt 0 ]; then
+    echo "::error::modules not classified for smoke coverage: ${missing[*]}"
+    echo "Add each to SAFE / HARDWARE / COMPOSITOR in test/smoke/coverage.sh"
+    echo "(and, if it can run headless, to the matrix in modules.sh)."
+    exit 1
+fi
+echo "✓ all ${#FACTORY[@]} factory modules are classified for smoke coverage"