Merge quattro and route refreshes through omarchy-update-pacman

Upstream now runs every Omarchy-owned pacman transaction through the
hidden omarchy-update-pacman helper so a mid-transaction systemd reexec
cannot kill it. Keep the deferred pre-refresh-pacman hook and the
command-scoped sudo wrapper, and call the helper from the refresh and
channel commands; the wrapper still applies to the helper's own sudo.

The sudo boundary fixture copies the helper into its root and runs a
systemd-run stand-in that execs the wrapped pacman step in place.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

config/wireplumber/wireplumber.conf.d/kef-lsx-no-suspend.conf

@@ -0,0 +1,19 @@
+## Never suspend the KEF LSX II LT USB sink.
+## The speaker's USB firmware stops answering control requests when the host
+## stops the stream after idle (usb_set_interface -110), and only a replug
+## recovers it. Keeping the stream open avoids the trigger.
+
+monitor.alsa.rules = [
+  {
+    matches = [
+      {
+        node.name = "~alsa_output.usb-KEF_LSX_II_LT.*"
+      }
+    ]
+    actions = {
+      update-props = {
+        session.suspend-timeout-seconds = 0
+      }
+    }
+  }
+]