Merge quattro and route refreshes through omarchy-update-pacman

Upstream now runs every Omarchy-owned pacman transaction through the
hidden omarchy-update-pacman helper so a mid-transaction systemd reexec
cannot kill it. Keep the deferred pre-refresh-pacman hook and the
command-scoped sudo wrapper, and call the helper from the refresh and
channel commands; the wrapper still applies to the helper's own sudo.

The sudo boundary fixture copies the helper into its root and runs a
systemd-run stand-in that execs the wrapped pacman step in place.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

bin/omarchy-refresh-pacman

@@ -36,7 +36,8 @@ if [[ $hook_mode != "run-deferred" ]]; then
   echo "Setting channel to $channel"
   sudo cp -f "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" /etc/pacman.conf
   sudo cp -f "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" /etc/pacman.d/mirrorlist
-  sudo env OMARCHY_UPDATE_PACMAN=1 pacman -Syyuu --noconfirm
+  # Reset all package DBs and then update
+  omarchy-update-pacman -Syyuu --noconfirm
 fi
 
 # Keep the historical hook name, but finish every privileged refresh operation