OM-SEC-01: Make passwordless sudo expiry fail closed

etc/tmpfiles.d/omarchy-nopasswd-sudo.conf

@@ -1,5 +1,5 @@
-# omarchy-sudo-passwordless writes /etc/sudoers.d/99-omarchy-nopasswd-<user> and
-# arms a transient systemd-run timer to remove it again. Transient units do not
-# survive a reboot, so remove any remaining grant during early boot. Boot-only
-# (r!) ensures a later systemd-tmpfiles --remove cannot cut a live grant short.
+# omarchy-sudo-passwordless creates grants in this owned filename namespace.
+# Transient expiry timers do not survive reboot, so early boot removes every
+# remaining grant. The boot-only modifier prevents later tmpfiles runs from
+# shortening a live, explicitly requested window.
 r! /etc/sudoers.d/99-omarchy-nopasswd-*