Rewrite polkit-1 in place with sed -i so an interrupted migration cannot truncate it

`sudo tee` truncates the live PAM file before writing it, so a migration interrupted in between left /etc/pam.d/polkit-1 empty; the next run then failed the layout check, exited 0, and was marked complete with polkit authentication broken. sed -i writes a temporary file and renames it into place, as the setup commands already do, so the original stays intact until the rewrite is whole and a failed sed needs no restore.

The test's broken-write stub now empties the file instead of discarding the write, so the restore assertion fails if the restore is removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Codex Medium <noreply@openai.com>

migrations/1788256455.sh

@@ -61,11 +61,9 @@ if [[ -f $polkit ]] && is_omarchy_vulnerable_stack "$polkit"; then
 
   # Replace only the bare pam_unix lines; keep comments, blank lines, and the
   # hardware-auth (gate / pam_fprintd / pam_u2f) lines exactly as they are.
-  rebuilt=$(sed -E 's/^(auth|account|password|session)([[:space:]]+)required[[:space:]]+pam_unix\.so[[:space:]]*$/\1\2include system-auth/' "$polkit")
-
-  if ! printf '%s\n' "$rebuilt" | sudo tee "$polkit" >/dev/null; then
-    echo "Could not write $polkit; restoring the original." >&2
-    sudo cp -a "$backup" "$polkit" || true
+  # sed -i renames a complete file into place, so an interrupted run never leaves polkit-1 truncated.
+  if ! sudo sed -i -E 's/^(auth|account|password|session)([[:space:]]+)required[[:space:]]+pam_unix\.so[[:space:]]*$/\1\2include system-auth/' "$polkit"; then
+    echo "Could not rewrite $polkit; leaving it unchanged so the migration retries." >&2
     exit 1
   fi