Merge cn-region-switch (with omarchy #13690)

# Conflicts:
#	AGENTS.md
#	bin/omarchy-refresh-pacman
#	default/omarchy/omarchy-menu.jsonc
#	install/post-install/pacman.sh
#	shell/plugins/menu/MenuModel.js
#	test/shell.d/menu-test.sh

bin/omarchy-refresh-pacman

@@ -42,11 +42,31 @@ if [[ ! -f $templates/pacman-$channel.conf || ! -f $templates/mirrorlist-$channe
   exit 1
 fi
 
+# Render the channel templates plus this machine's regional additions as the
+# caller, so root only copies finished files. The scratch directory goes on
+# every exit, including a failed render, a refused sudo prompt, or a signal;
+# revoking the sudo timestamp stays the last thing the exit path does.
+rendered=$(mktemp -d)
+cleanup_refresh() {
+  local status=$?
+  rm -rf "$rendered"
+  omarchy_security_exit_with_revoked_sudo "$status"
+}
+trap cleanup_refresh EXIT
+# Regions render x86 pacman only (omarchy #13690); other platforms copy their templates.
+if [[ $platform == x86 ]]; then
+  "$OMARCHY_PATH/bin/omarchy-apply-pacman" --render "$channel" "$rendered"
+else
+  cp "$templates/pacman-$channel.conf" "$rendered/pacman.conf"
+  cp "$templates/mirrorlist-$channel" "$rendered/mirrorlist"
+fi
+
 sudo cp -f /etc/pacman.conf /etc/pacman.conf.bak
 sudo cp -f /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.bak
 echo "Setting channel to $channel"
-sudo cp -f "$templates/pacman-$channel.conf" /etc/pacman.conf
-sudo cp -f "$templates/mirrorlist-$channel" /etc/pacman.d/mirrorlist
+sudo cp -f "$rendered/pacman.conf" /etc/pacman.conf
+sudo cp -f "$rendered/mirrorlist" /etc/pacman.d/mirrorlist
+rm -rf "$rendered"
 
 # Allow user customization of /etc/pacman.conf before the upgrade runs, so
 # custom repositories and IgnorePkg entries shape the downgrade-capable