Complete command-scoped authentication across update phases

bin/omarchy-channel-set

@@ -83,7 +83,7 @@ if [[ -n $dev_checkout ]]; then
   omarchy-state set reboot-required
 fi
 
-omarchy-refresh-pacman "$pacman_channel"
+omarchy-refresh-pacman "$pacman_channel" defer-hook
 # --ask 4 accepts omarchy <-> omarchy-dev replacement prompts without file overwrites.
 sudo env OMARCHY_UPDATE_PACMAN=1 pacman -S --needed --noconfirm --ask 4 "${packages[@]}"
 
@@ -97,3 +97,6 @@ if [[ -z $dev_checkout ]]; then
 fi
 
 omarchy-update -y
+
+# No channel-owned privileged work follows the historical refresh hook.
+omarchy-refresh-pacman "$pacman_channel" run-deferred