omarchy-settings: pass #13362's platform-aware hooks through on aarch64

omacom/omarchy#13362 sets HOOKS per platform inside 00-omarchy-hooks.conf,
with no column-0 HOOKS= line, so the aarch64 build failed on it; settings-dev
tracks quattro automatically and would break as soon as it lands. Wrap only a
single-line HOOKS=(...), refuse any other column-0 HOOKS=, then source the
shipped files onto a Mac line and a stock line: the Mac line must come through
unchanged and the stock one must not. Back up 00-omarchy-hooks.conf when it
ships, and refuse it without the omarchy-hw-platform copy it asks.

The test now uses the real v4.0.4 hooks file, #13362's two files and
omarchy-mac-boot's 90-94 fragments, and covers upgrades over a hand-restored
file.

tests/fixtures/settings-boot/omarchy-13362/00-omarchy-hooks.conf

@@ -0,0 +1,37 @@
+# The platform's HOOKS baseline. mkinitcpio sources mkinitcpio.conf and then
+# every drop-in here in name order, so the baseline sorts first and the drop-ins
+# after it add their hooks to it instead of being overwritten by it.
+#
+# Apple Silicon boots a systemd initramfs, and its platform package adds the
+# firmware and encryption hooks. Every other machine keeps the busybox line. The
+# runtime's detector answers, or else the copy omarchy-settings ships for its
+# platform guard, so a settings package newer than the runtime still places a
+# Mac. Without either, the busybox line stays. A detector that cannot place the
+# machine stops the build rather than let it produce an image for the wrong
+# platform.
+_omarchy_platform=""
+_omarchy_detector=$(command -v omarchy-hw-platform) || _omarchy_detector=/usr/share/libalpm/scripts/omarchy-hw-platform
+if [[ -x $_omarchy_detector ]]; then
+  _omarchy_platform=$("$_omarchy_detector") || return 1
+fi
+
+# A Mac whose mkinitcpio.conf carries the asahi hook, or the busybox encrypt
+# hook that unlocks it through cryptdevice= (sd-encrypt cannot parse that), boots
+# the initramfs its platform set up without the Apple boot package, as a legacy
+# install does. Its line stays as it is. The asahi hook also marks such a root
+# off a Mac, as in a chroot or a VM.
+if [[ " ${HOOKS[*]:-} " == *" asahi "* ]] ||
+  [[ $_omarchy_platform == "apple-silicon" && " ${HOOKS[*]:-} " == *" encrypt "* ]]; then
+  _omarchy_platform=platform-owned
+fi
+
+case $_omarchy_platform in
+  platform-owned) ;;
+  apple-silicon)
+    HOOKS=(base systemd plymouth autodetect microcode modconf kms keyboard sd-vconsole block filesystems fsck)
+    ;;
+  *)
+    HOOKS=(base udev plymouth keyboard autodetect microcode modconf kms keymap consolefont block encrypt filesystems fsck btrfs-overlayfs)
+    ;;
+esac
+unset _omarchy_platform _omarchy_detector

tests/fixtures/settings-boot/omarchy-13362/omarchy_hooks.conf

@@ -0,0 +1,53 @@
+# Adjusts the baseline HOOKS from 00-omarchy-hooks.conf. It stays apart from
+# the baseline because it reads what the hardware drop-ins sorting before it set.
+
+# The proprietary NVIDIA driver does early KMS itself: nvidia.conf (written by
+# install/hardware/nvidia.sh, sourced before this file) early-loads nvidia_drm
+# with modeset=1. Keeping the kms hook on such a system makes autodetect pull
+# in nouveau — and ~100 MB of its GSP firmware — for a driver that never runs.
+# Drop kms only when nvidia_drm is early-loaded and NVIDIA owns every display
+# controller. Hybrid systems keep kms: their iGPU still needs it for early
+# KMS at the LUKS prompt. So does anything unexpected, like a PCI tree that
+# cannot be read.
+#
+# This reads MODULES midway through mkinitcpio's drop-in sourcing, so a
+# later-sorting drop-in that resets MODULES outright — surface_device_modules.conf
+# does — would strip nvidia_drm after kms was already dropped. Every machine
+# Omarchy writes such a file for carries an Intel iGPU, which keeps kms here
+# through the scan below; keep it that way.
+if [[ " ${MODULES[*]:-} " == *" nvidia_drm "* ]]; then
+  _omarchy_nvidia_gpu=0
+  _omarchy_other_gpu=0
+  for _omarchy_pci in "${OMARCHY_PCI_DEVICES_PATH:-/sys/bus/pci/devices}"/*; do
+    if [[ ! -r $_omarchy_pci/class || ! -r $_omarchy_pci/vendor ]]; then
+      # An unreadable device could be another GPU. Inconclusive keeps kms.
+      _omarchy_other_gpu=1
+      continue
+    fi
+    [[ $(<"$_omarchy_pci/class") == "0x03"* ]] || continue
+    if [[ $(<"$_omarchy_pci/vendor") == "0x10de" ]]; then
+      _omarchy_nvidia_gpu=1
+    else
+      _omarchy_other_gpu=1
+    fi
+  done
+  if ((_omarchy_nvidia_gpu && !_omarchy_other_gpu)); then
+    _omarchy_hooks=()
+    for _omarchy_hook in "${HOOKS[@]}"; do
+      [[ $_omarchy_hook == "kms" ]] || _omarchy_hooks+=("$_omarchy_hook")
+    done
+    HOOKS=("${_omarchy_hooks[@]}")
+  fi
+  unset _omarchy_nvidia_gpu _omarchy_other_gpu _omarchy_pci _omarchy_hooks _omarchy_hook
+fi
+
+# Bundle vconsole.conf so Plymouth uses the configured keyboard layout at the
+# LUKS prompt, but only when that layout types Latin letters. Passphrases are
+# Latin characters, so bundling a Hebrew/Greek/Cyrillic/Arabic layout would
+# make the correct passphrase untypeable and lock the user out.
+if [[ -f /etc/vconsole.conf ]]; then
+  case $(. /etc/vconsole.conf && echo "${XKBLAYOUT%%,*}") in
+    af | am | ara | bd | bg | by | et | ge | gr | il | in | iq | ir | kg | kh | kz | la | lk | mk | mm | mn | mv | np | rs | ru | sy | th | tj | ua) ;;
+    *) FILES+=(/etc/vconsole.conf) ;;
+  esac
+fi