Sync the whole test suite and run it in the guest

--sync-omarchy now pushes all of test/ (the security coverage lives in
shell.d as well as acceptance.d), and the acceptance run gets
OMARCHY_ACCEPTANCE_SUDO_PASSWORD so the suite's opt-in sshd hardening
exercise can run against the throwaway VM.

--sync-all additionally runs the CLI and shell suites inside the guest
from the synced tree. The acceptance suite always runs against
/usr/share/omarchy either way: VM runs verify the finished product, and
qs matches shell instances by config path, so pointing the suite at the
synced tree just reads the session shell as "not running".

bin/omarchy-iso-make

@@ -158,7 +158,15 @@ else
   DOCKER_ARGS+=(--pull=always)
 fi
 
-docker run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT
+# The docker group is root-equivalent, so Omarchy operators stay out of it on
+# purpose. When the socket refuses the calling user, run the client through
+# sudo instead of requiring group membership.
+DOCKER=(docker)
+if ! docker version &>/dev/null; then
+  DOCKER=(sudo docker)
+fi
+
+"${DOCKER[@]}" run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT
 
 latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*.iso | head -n1)
 iso_ref="${latest_iso%.*}-$OMARCHY_ISO_REF.iso"

bin/omarchy-iso-release

@@ -1,5 +1,10 @@
 #!/bin/bash
 
+# A failed step must stop the release: without this, a make that dies (say,
+# docker permission denied) falls through to signing and uploading whatever
+# stale ISO release/ already holds, under the new release's name.
+set -e
+
 MAKE_ARGS=()
 ISO_REF=quattro
 RELEASE_SUFFIX=""
@@ -70,3 +75,9 @@ fi
 echo -e "\e[32mSHA256 for $ISO_REF ISO: $iso_sha\e[0m"
 
 omarchy-iso-upload "$release_iso"
+
+# The whole point of a release is handing someone this pair.
+echo -e "\e[32mReleased $ISO_REF ISO $BUILD_VERSION\e[0m"
+echo "  URL:    https://iso.omarchy.org/${release_iso##*/}"
+echo "  SHA256: $iso_sha"
+echo "  Local:  $release_iso"

bin/omarchy-iso-test

@@ -18,9 +18,10 @@
 #                      first boot runs omarchy-provision-owner and creates it there
 #   --reuse-base       Skip the install phase if a base image already exists
 #   --install-only     Stop after producing the installed base image
-#   --sync-omarchy DIR Push DIR's test/acceptance into the guest before running
+#   --sync-omarchy DIR Push DIR's test suite into the guest before running
 #                      (defaults to OMARCHY_PATH when the suite is present)
 #   --sync-all DIR     Push all of DIR (bin/config/shell/test) into the guest
+#                      and also run the CLI and shell suites there
 #   --port PORT        Host port forwarded to guest SSH (default 2222)
 #   --memory MB        VM memory (default 8192)
 #   --timeout SECS     Install timeout (default 2400)
@@ -211,6 +212,7 @@ start_vm() {
     -device virtio-blk-pci,drive=drive0,bootindex=1 \
     -device virtio-vga \
     -display none \
+    -vnc 127.0.0.1:5 \
     -usb -device usb-tablet \
     -netdev user,id=net0,hostfwd=tcp:127.0.0.1:$SSH_PORT-:22 \
     -device virtio-net-pci,netdev=net0 \
@@ -400,7 +402,7 @@ guest_layer_absent() {
 }
 
 cleanup_shortcut_state() {
-  ssh_session 'for plugin in omarchy.launcher omarchy.menu omarchy.emojis omarchy.clipboard omarchy.audio; do
+  ssh_session 'for plugin in omarchy.menu omarchy.emojis omarchy.clipboard omarchy.audio; do
     omarchy-shell shell hide "$plugin" >/dev/null 2>&1 || true
   done
   while read -r address; do
@@ -577,8 +579,8 @@ shortcut_smoke_phase() {
 
   local status=0
   local name chord namespace plugin
-  local shortcuts='launcher|meta_l-spc|omarchy-launcher|omarchy.launcher
-menu|meta_l-alt-spc|omarchy-menu|omarchy.menu
+  local shortcuts='menu|meta_l-spc|omarchy-menu|omarchy.menu
+apps-menu|meta_l-alt-spc|omarchy-menu|omarchy.menu
 emojis|meta_l-ctrl-e|omarchy-emojis|omarchy.emojis
 clipboard|meta_l-ctrl-v|omarchy-clipboard|omarchy.clipboard
 audio-panel|meta_l-ctrl-a|omarchy-keyboard-panel|omarchy.audio'
@@ -631,7 +633,11 @@ drive_configurator() {
     capture_console "success-installer-04-prepare-disk-warning-encrypted"
     if ! $ENCRYPT; then
       press ctrl-c
-      wait_for_screen "without encryption" 30
+      # The toggled confirm ("Yes, install without encryption") is a highlighted
+      # button OCR cannot read, so don't wait for it. A failed toggle still
+      # surfaces: the encrypted install stalls at the LUKS prompt on first boot
+      # and SSH never comes up.
+      sleep 2
       capture_console "success-installer-05-prepare-disk-warning-unencrypted"
     fi
     press ret
@@ -695,7 +701,11 @@ drive_configurator() {
   capture_console "success-installer-12-disk-warning-encrypted"
   if ! $ENCRYPT; then
     press ctrl-c # toggles the confirm to the unencrypted flow
-    wait_for_screen "without encryption" 30
+    # The toggled confirm ("Yes, install without encryption") is a highlighted
+    # button OCR cannot read, so don't wait for it. A failed toggle still
+    # surfaces: the encrypted install stalls at the LUKS prompt on first boot
+    # and SSH never comes up.
+    sleep 2
     capture_console "success-installer-13-disk-warning-unencrypted"
   fi
   press ret
@@ -1058,17 +1068,14 @@ sync_omarchy() {
     log "Syncing $SYNC_DIR into the guest"
     tar -C "$SYNC_DIR" --exclude .git -cf - . | ssh_guest "mkdir -p $target && tar -C $target -xf -"
   else
-    log "Syncing $SYNC_DIR/test/acceptance into the guest"
-    tar -C "$SYNC_DIR/test" -cf - acceptance acceptance.d | ssh_guest "mkdir -p $target/test && tar -C $target/test -xf -"
+    log "Syncing $SYNC_DIR/test into the guest"
+    tar -C "$SYNC_DIR" -cf - test | ssh_guest "mkdir -p $target && tar -C $target -xf -"
   fi
 }
 
 acceptance_phase() {
   log "Booting acceptance VM from base image overlay"
 
-  local guest_omarchy_path="/usr/share/omarchy"
-  $SYNC_ALL && guest_omarchy_path=".local/share/omarchy"
-
   qemu-img create -f qcow2 -b "$BASE_DISK" -F qcow2 "$RUN_DIR/run.qcow2" >/dev/null
   start_vm "$RUN_DIR/run.qcow2" "$RUN_DIR/serial.log"
 
@@ -1078,8 +1085,19 @@ acceptance_phase() {
   local status=0
   shortcut_smoke_phase || status=1
 
+  # The synced tree is a full checkout under --sync-all; run the host-style
+  # CLI and shell suites in the guest too before the graphical acceptance
+  # run. They derive their root from their own location in the synced tree.
+  if $SYNC_ALL; then
+    log "Running CLI and shell suites in the guest"
+    ssh_guest "bash .local/share/omarchy/test/all" || status=$?
+  fi
+
+  # The product under test is always the installed tree — VM runs verify the
+  # finished product, never a dev-linked checkout.
   log "Running acceptance suite"
-  ssh_guest "OMARCHY_PATH=$guest_omarchy_path OMARCHY_ACCEPTANCE_DIR=/tmp/omarchy-acceptance bash .local/share/omarchy/test/acceptance" || status=$?
+  ssh_guest "OMARCHY_PATH=/usr/share/omarchy OMARCHY_ACCEPTANCE_DIR=/tmp/omarchy-acceptance \
+    OMARCHY_ACCEPTANCE_SUDO_PASSWORD=$GUEST_PASSWORD bash .local/share/omarchy/test/acceptance" || status=$?
 
   log "Collecting artifacts into $RUN_DIR"
   ssh_guest "tar -C /tmp -cf - omarchy-acceptance 2>/dev/null" | tar -C "$RUN_DIR" -xf - || true

configs/pacman-online-rc.conf

@@ -27,7 +27,7 @@ Include = /etc/pacman.d/mirrorlist
 
 [omarchy]
 SigLevel = Optional TrustAll
-Server = https://pkgs.omarchy.org/edge/$arch
+Server = https://pkgs.omarchy.org/rc/$arch
 
 [arch-mact2]
 Server = https://mirror.funami.tech/arch-mact2/os/x86_64