Merge quattro into USB authorization branch

install/user/first-run/enable-user-units.sh

@@ -14,9 +14,12 @@ set -euo pipefail
 systemctl --user daemon-reload
 systemctl --user enable --now \
   bt-agent.service \
+  owed.service \
   omarchy-recover-internal-monitor.service \
   omarchy-sleep-lock.service \
   omarchy-migrate-notify.service \
   omarchy-fcitx5.service \
   omarchy-crash-watch.service \
   omarchy-usb-authorization.service
+
+omarchy-hook-install theme-set /usr/share/owe/10-owe-sync

install/user/mise-work.sh

@@ -2,13 +2,6 @@
 mkdir -p "$HOME/Work"
 mkdir -p "$HOME/Work/tries"
 
-cat >"$HOME/Work/.mise.toml" <<'EOF'
-[env]
-_.path = "{{ cwd }}/bin"
-EOF
-
-mise trust ~/Work/.mise.toml
-
 # Offline installs unpack the Node tarball bundled by the ISO: from
 # /opt/packages in the ISO chroot, or from the copy staged in provisioning state when
 # omarchy-provision-owner finalizes the user at first boot.
@@ -37,6 +30,11 @@ if [[ -n $NODE_PACKAGE_DIR ]]; then
     mkdir -p "$NODE_INSTALL_DIR"
     tar -xzf "$NODE_TARBALL" --strip-components=1 -C "$NODE_INSTALL_DIR"
     mise use -g node@"$NODE_VERSION"
+
+    # That pinned the exact bundled version, which would exempt Node from
+    # mise up forever. Loosen it to latest, like an online install gets:
+    # mise resolves latest to the installed version while offline.
+    mise config set tools.node latest --file "$HOME/.config/mise/config.toml"
   fi
 else
   mise use -g node@latest