Resolve the passwordless sudo helper by name in its migration

Pinning /usr/bin ran the packaged helper even where the migration came from somewhere else. Under a dev link the migration is read from the checkout while /usr/bin still holds the last installed package, and a package predating __migrate prints its usage and fails the update. By name, the unprivileged call goes through PATH and the sudo call through secure_path, which is how other migrations reach their helpers and which lands on /usr/bin on an install.

Co-Authored-By: Codex XHigh <noreply@openai.com>

migrations/1788163635.sh

@@ -1,6 +1,8 @@
 echo "Remove legacy temporary passwordless sudo grants"
 
 # Migration queues are per-user; the privileged repair is once per machine.
-if ! /usr/bin/omarchy-sudo-passwordless __migration-complete; then
-  sudo /usr/bin/omarchy-sudo-passwordless __migrate
+# By name: secure_path resolves /usr/bin on an install and the checkout under a
+# dev link, where the installed package may predate __migrate.
+if ! omarchy-sudo-passwordless __migration-complete; then
+  sudo omarchy-sudo-passwordless __migrate
 fi