Refresh the passwordless sudo indicator on change instead of polling (#15026)

* Refresh the passwordless sudo indicator on change instead of polling

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Refresh the sudo indicator after failed changes and on a wall-clock deadline

Addresses Codex review: a rolled-back renewal skipped the refresh, the monotonic user timer paused through suspend, and default timer accuracy allowed a minute's delay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Test the sudo indicator refreshes by running the grant flows

Replace source-string checks with runs of timed, renewed, failed, permanent and disable flows against the fixture, asserting the recorded omarchy-shell refresh and wall-clock systemd-run --user timer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

shell/plugins/bar/indicators/PasswordlessSudo.qml

@@ -31,19 +31,15 @@ BarIndicator {
   onBarChanged: refresh()
   Component.onCompleted: refresh()
 
+  // No polling: each probe is a hardened script plus sudo calls that can log.
+  // omarchy-sudo-passwordless refreshes omarchy.indicators on enable, disable
+  // and expiry instead.
   Connections {
     target: root.indicatorHost
     ignoreUnknownSignals: true
     function onRefreshRequested() { root.refresh() }
   }
 
-  Timer {
-    interval: 5000
-    repeat: true
-    running: !!root.bar
-    onTriggered: root.refresh()
-  }
-
   Process {
     id: statusProc
     command: ["omarchy-sudo-passwordless", "--active"]