Arming the built-in xHCI root hubs made them wake on hub-level events (USB-C PD negotiation, SD card reader, internal peripherals), causing the laptop to immediately self-wake from suspend. Drop the root-hub rule and arm only the keyboard leaf by VID:PID; a leaf device's remote-wakeup propagates through the hub without the hub's own wakeup flag being set.