Refresh the passwordless sudo indicator on change instead of polling (#15026)

* Refresh the passwordless sudo indicator on change instead of polling

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Refresh the sudo indicator after failed changes and on a wall-clock deadline

Addresses Codex review: a rolled-back renewal skipped the refresh, the monotonic user timer paused through suspend, and default timer accuracy allowed a minute's delay.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Test the sudo indicator refreshes by running the grant flows

Replace source-string checks with runs of timed, renewed, failed, permanent and disable flows against the fixture, asserting the recorded omarchy-shell refresh and wall-clock systemd-run --user timer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/shell.d/fixtures/passwordless-sudo-test.sh

@@ -58,6 +58,8 @@ case "$name" in
     [[ ${TEST_POST_PUBLISH_FAIL:-0} != 1 ]] || : >"$TEST_GRANT_ROOT/run/omarchy-sudo-passwordless-package-removing"
     ;;
   systemd-run)
+    # The indicator's user refresh timer is not the root expiry timer.
+    [[ ${1:-} != --user ]] || exit 0
     [[ ${TEST_TIMER_FAIL:-0} != 1 ]] || exit 1
     if [[ ${TEST_CANCEL_ENABLE:-0} == 1 ]]; then kill -TERM "$PPID"; fi
     ;;
@@ -67,6 +69,7 @@ case "$name" in
   date)
     if [[ ${TEST_EXPIRED:-0} == 1 && $* == '-u +%Y%m%d%H%M%SZ' ]]; then echo 99991231235959Z; else /usr/bin/date "$@"; fi
     ;;
+  omarchy-shell) ;;
   getent) printf '%s:x:1000:1000:Test:/nonexistent:/bin/bash\n' "${TEST_ACCOUNT:-audituser}" ;;
   sudo)
     if [[ ${1:-} == -h ]]; then echo 'usage: sudo [-N] command'; exit 0; fi
@@ -86,6 +89,7 @@ case "$name" in
       TEST_EUID=0 /usr/bin/bash -p "$@"
     else
       [[ ${2:-} != __status ]] || exit "${TEST_STATUS:-3}"
+      [[ ${2:-} != __enable || ${TEST_ENABLE_FAIL:-0} != 1 ]] || exit 1
     fi
     ;;
   gum)
@@ -100,7 +104,7 @@ case "$name" in
 esac
 STUB
 chmod +x "$test_tmp/bin/mock"
-for name in stat chown install rm mv systemd-run systemctl date getent sudo gum; do
+for name in stat chown install rm mv systemd-run systemctl date getent sudo gum omarchy-shell; do
   ln -s mock "$test_tmp/bin/$name"
 done
 
@@ -114,7 +118,7 @@ for name in ('omarchy-sudo-passwordless', 'omarchy-security-functions'):
         target = str(temp/'hooks') if path == '/usr/share/libalpm/hooks' else str(temp) + path
         text = text.replace(path, target)
     text = text.replace('((EUID == 0))', '((${TEST_EUID:-1} == 0))')
-    for command in ('stat', 'chown', 'install', 'rm', 'mv', 'systemd-run', 'systemctl', 'date', 'getent', 'sudo', 'gum'):
+    for command in ('stat', 'chown', 'install', 'rm', 'mv', 'systemd-run', 'systemctl', 'date', 'getent', 'sudo', 'gum', 'omarchy-shell'):
         text = text.replace('/usr/bin/' + command, str(temp/'bin'/command))
     (temp/name).write_text(text)
     (temp/name).chmod(0o755)