Fail closed when passwordless sudo expiry cannot arm

Remove stale passwordless sudo grants during boot and revoke a live grant immediately if its transient expiry timer cannot be created. Exercise both failure paths and the shipped tmpfiles rule against a disposable root.

Co-authored-by: Adolanium <94890352+Adolanium@users.noreply.github.com>

etc/tmpfiles.d/omarchy-nopasswd-sudo.conf

@@ -0,0 +1,5 @@
+# omarchy-sudo-passwordless writes /etc/sudoers.d/99-omarchy-nopasswd-<user> and
+# arms a transient systemd-run timer to remove it again. Transient units do not
+# survive a reboot, so remove any remaining grant during early boot. Boot-only
+# (r!) ensures a later systemd-tmpfiles --remove cannot cut a live grant short.
+r! /etc/sudoers.d/99-omarchy-nopasswd-*