Flag a reboot when the docker group changes (backport of #8080)

Backport of the reboot flag (PR #8080, merged to quattro as 1565919c) onto the
v4-0-1 release branch, on top of the #8056 backport it follows.

Group membership is fixed at login, so removing (or adding) the docker group
does not take effect in the running session. The existing-user migration and the
Setup > Security toggles now call omarchy-state set reboot-required, so
omarchy-update-restart prompts for the reboot that actually applies the change
and the bar shows it pending. A plain log out and back in still works.

The migration test now exercises the real removal command and omarchy-state
rather than a stub, asserting the reboot flag is set on removal and left alone
when the user is already out of the group.

Clean cherry-pick on top of the #8056 backport: all three files are
byte-identical to quattro, so merging v4-0-1 into quattro resolves without a
conflict. omarchy-state and omarchy-update-restart are unchanged on this branch
and read the same ~/.local/state/omarchy/reboot-required marker. test/shell
passes: 186 files.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018DEMYa9UWtroz93DhMTtcV

bin/omarchy-remove-security-sudoless-docker

@@ -13,8 +13,13 @@ fi
 echo "Removing $USER from the docker group..."
 sudo gpasswd -d "$USER" docker >/dev/null
 
+# Group membership is fixed at login, so the running session keeps its docker
+# access until it ends. Flag a reboot so omarchy-update-restart prompts for one
+# (and the bar shows it pending); a plain log out and back in works too.
+omarchy-state set reboot-required
+
 echo ""
-echo "Sudoless Docker DISABLED. Log out and back in for the change to take effect."
+echo "Sudoless Docker DISABLED. Reboot (or log out and back in) for the change to take effect."
 echo "Docker access now goes through a polkit/sudo prompt again: the Docker TUI"
 echo "(Super + Shift + D) and the Windows VM will ask when they need it, and the"
 echo "plain 'docker' CLI runs under sudo."

bin/omarchy-setup-security-sudoless-docker

@@ -28,8 +28,12 @@ echo ""
 
 if gum confirm "Enable sudoless Docker? This gives anything running as you passwordless root."; then
   sudo usermod -aG docker "$USER"
+  # Group membership is fixed at login, so docker won't be reachable without a
+  # prompt until the session restarts. Flag a reboot so omarchy-update-restart
+  # prompts for one (and the bar shows it pending).
+  omarchy-state set reboot-required
   echo ""
-  echo "Sudoless Docker ENABLED. Log out and back in (or run 'newgrp docker')"
+  echo "Sudoless Docker ENABLED. Reboot, or log out and back in (or run 'newgrp docker'),"
   echo "for the new group membership to take effect."
   echo "To disable it again, run: omarchy-remove-security-sudoless-docker"
 else