Bind update inhibitor cleanup to owned process identity

Keep inhibitor state in validated private directories and verify the recorded owner, PID, start time and launch token before signaling. Authenticate the held command before detaching and drop it back to the invoking user.

Serialize launch and cancellation, identify the child before publishing its state, and preserve caller-owned idle choices. Cover cross-account fallback state, process identity, cancellation, retry, and update-lock handling with isolated regressions.

test/shell.d/fixtures/sudo-boundary-test.sh

@@ -21,7 +21,7 @@ source, target, name = map(Path,sys.argv[1:])
 p=target/name
 p.parent.mkdir(parents=True,exist_ok=True)
 s=(source/name).read_text().replace('$HOME', '$SUDO_TEST_HOME')
-for command in ['sudo','pacman','omarchy-pkg-missing','systemd-inhibit','setpriv','snapper']:
+for command in ['sudo','pkexec','pacman','omarchy-pkg-missing','systemd-inhibit','setpriv','snapper']:
  s=s.replace('/usr/bin/'+command, str(target/'mock'/command))
 s=s.replace('PATH=/usr/bin:/usr/sbin:/bin:/sbin', 'PATH="'+str(target/'bin')+':/usr/bin:/usr/sbin:/bin:/sbin"')
 p.write_text(s)