Merge quattro and route refreshes through omarchy-update-pacman

Upstream now runs every Omarchy-owned pacman transaction through the
hidden omarchy-update-pacman helper so a mid-transaction systemd reexec
cannot kill it. Keep the deferred pre-refresh-pacman hook and the
command-scoped sudo wrapper, and call the helper from the refresh and
channel commands; the wrapper still applies to the helper's own sudo.

The sudo boundary fixture copies the helper into its root and runs a
systemd-run stand-in that execs the wrapped pacman step in place.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

etc/limine-entry-tool.d/omarchy-defaults.conf

@@ -15,7 +15,8 @@ ENABLE_LIMINE_FALLBACK=yes
 # Find and add other bootloaders
 FIND_BOOTLOADERS=yes
 
-BOOT_ORDER="*, *fallback, Snapshots"
+# Keep T2 Macs on their specialized kernel; prefer linux-omarchy elsewhere.
+BOOT_ORDER="linux-t2, linux-omarchy, linux-omarchy-*, *, *fallback, Snapshots"
 
 # Snapper is configured with NUMBER_LIMIT="5" (see default/snapper/root), but
 # limine-snapper-sync can see the newly created sixth snapshot before cleanup

etc/mise/conf.d/omarchy.toml

@@ -0,0 +1,4 @@
+# Keep Cursor optional while applying these options whenever mise installs it.
+# Expose only its launcher so the bundled Node cannot shadow the user's Node.
+[tool_alias]
+cursor-agent = 'http:cursor-agent[bin_path=bin,postinstall=mkdir -p "$MISE_TOOL_INSTALL_PATH/bin" && ln -sfn ../dist-package/cursor-agent "$MISE_TOOL_INSTALL_PATH/bin/cursor-agent"]'

etc/sysctl.d/99-omarchy-sysctl.conf

@@ -1,6 +1,12 @@
 # Solve common flakiness with SSH (MTU discovery on flaky links).
 net.ipv4.tcp_mtu_probing=1
 
+# BBR estimates bottleneck bandwidth and minimum RTT and paces to them, where
+# cubic keeps pushing until packets drop. That cuts queueing latency
+# (bufferbloat) on fast links. fq is the qdisc BBR is built to pace through.
+net.core.default_qdisc=fq
+net.ipv4.tcp_congestion_control=bbr
+
 # Tune reclaim for swap on zram, which is orders of magnitude faster than the
 # disk swapfile these defaults assume.
 

etc/udev/rules.d/60-omarchy-io-scheduler.rules

@@ -0,0 +1,8 @@
+# Kyber keeps reads in their own queue and throttles the depth it submits to
+# hold a 2ms read latency target, so interactive reads keep flowing while a
+# large build, copy, or package upgrade floods the disk with writes. The
+# kernel's own pick (none or mq-deadline, depending on the device) does not
+# regulate latency once the queue fills. Whole disks only: partitions have no
+# scheduler of their own, and zram is memory with nothing to schedule. Zoned
+# btrfs disks are moved back to mq-deadline by 64-btrfs-zoned.rules.
+ACTION=="add|change", SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="nvme*|sd*|mmcblk*|vd*", ATTR{queue/scheduler}="kyber"