Keep the firmware reboot marker destination fixed

A caller-controlled marker path would let the privileged install command replace an unrelated file. Keep the production path fixed and redirect that literal only in isolated test copies. Cover hostile environment overrides without touching system files.

Co-Authored-By: GPT-6.1-Sol <noreply@openai.com>

Co-Authored-By: Greptile <165735046+greptile-apps[bot]@users.noreply.github.com>

install/hardware/dell-xps13-ptl-speaker-firmware.sh

@@ -3,7 +3,7 @@ if omarchy-hw-dell-xps13-dx13260-ptl; then
 
   # Keep newer Arch firmware when stable's snapshot supersedes the shim.
   if [[ -z $cirrus_package ]] || (( $(vercmp "${cirrus_package#* }" "20260810-3") < 0 )); then
-    firmware_pending="${OMARCHY_XPS13_FIRMWARE_PENDING:-/run/omarchy/xps13-ptl-speaker-firmware}"
+    firmware_pending="/run/omarchy/xps13-ptl-speaker-firmware"
     sudo install -Dm644 /dev/null "$firmware_pending"
 
     # [core] precedes [omarchy], so an unqualified target selects the older firmware.