Scope asdcontrol's passwordless sudo grant (#242)

Ship the least-privilege rule with asdcontrol so authorization follows the package lifecycle. Install it after older broad rules for safe staggered upgrades.

pkgbuilds/asdcontrol/asdcontrol.sudoers

@@ -0,0 +1,4 @@
+# Deny arbitrary asdcontrol arguments before allowing only the operations Omarchy uses.
+# Keep this filename late-sorting so it also overrides stale broader grants.
+ALL ALL=(ALL) !/usr/bin/asdcontrol
+%wheel ALL=(root) NOPASSWD: /usr/bin/asdcontrol ^--detect (/dev/(usb/)?hiddev[0-9]+)( /dev/(usb/)?hiddev[0-9]+)*$, /usr/bin/asdcontrol ^/dev/(usb/)?hiddev[0-9]+$, /usr/bin/asdcontrol ^/dev/(usb/)?hiddev[0-9]+ -- [+-]?[0-9]{1,3}%$