feat(m6): one-click install + apply controls on Environment page — 0.10.0

Make the environment report actionable, not just advisory.

Install (reuses M9 installer):
- Add GameMode, MangoHud, cpupower to the component catalog (so they also show
  on the Setup page); catalog.by_id() lookup.
- "tool not installed" findings (GameMode/MangoHud) get an Install button.

Apply runtime-reversible tunables (D22, realizing the D9 consent-gated milestone):
- core/fixes.py: dropdown of live options + Apply for CPU governor, NVIDIA
  persistence, PCIe ASPM policy, vm.swappiness, THP. One pkexec command each,
  no reboot, reverts on reboot; chosen value validated against live options;
  writes go to sysfs/procfs/nvidia-smi, never GRUB. GRUB/mitigations stay
  suggestion-only.
- Finding gained optional action (install) + fix (apply) ids; shared
  finding_card renders the matching control; Environment page wires both and
  re-checks after a change.

Tests for fixes (parse, command builders, value validation, gameenv wiring).
Docs: D22 added (amends D9); SPEC/MODULES/ROADMAP updated. 0.9.0 -> 0.10.0.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/DECISIONS.md

@@ -223,9 +223,25 @@ The next version is **determined by the Conventional Commit types** since the la
 `packaging/bump.sh` writes it into `__init__.py` + `pyproject.toml`. Rules live in
 `cliff.toml [bump]` (pre-1.0: `breaking_always_bump_major = false`).
 
+### D22 — Limited live apply of fixes (M6) — *DECIDED 2026-05-22; realizes the D9 milestone*
+D9 deferred auto-applying fixes to "a deliberate later milestone, gated behind explicit user
+consent." That milestone lands here, **scoped tightly to stay safe**:
+- **Only runtime-reversible settings** are applyable from the gaming-environment report (M6):
+  **CPU governor, NVIDIA persistence mode, PCIe ASPM policy, vm.swappiness, Transparent
+  HugePages.** Each takes effect immediately, needs **no reboot**, and reverts on reboot.
+- **How:** a dropdown of the live options + an Apply button per finding (`core/fixes.py`).
+  Applying runs a **single pkexec-elevated command** (one auth prompt); the chosen value is
+  validated against the live options first; writes target **sysfs/procfs or `nvidia-smi`** —
+  never the GRUB cmdline or a persistent config file.
+- **Still suggestion-only** (the read-only stance holds for these): GRUB-based `pcie_aspm=off`,
+  CPU **mitigations** changes (security-sensitive, need a reboot), and the shader-cache env var.
+- Everything remains **CLI-discoverable** (`rigdoctor gameenv` still prints the exact commands);
+  the apply UI is an additive convenience in the GUI, not the only path. Installing optional
+  tools (GameMode/MangoHud/cpupower) reuses the M9 installer and is likewise one-click.
+
 ## Open
 
-None currently — all tracked decisions (D1–D21) are resolved. New questions will be added
+None currently — all tracked decisions (D1–D22) are resolved. New questions will be added
 here as they arise. Remaining detail to flesh out during build: the tray's supporting-action
 set (D13), per-module apt package names, M12's tunnel/token specifics, and M13's
 update mechanism (APT repo vs. self-installed `.deb`).