Keep USB approvals portable and preserve approval prompts

migrations/1790608617.sh

@@ -0,0 +1,7 @@
+echo "Repair USB approval prompts and enable portable device approvals"
+
+# Preserve an explicit opt-out. Existing users with an active/enabled daemon
+# need a working watcher even if their old checkout link has become dangling.
+if systemctl is-enabled --quiet usbguard.service || systemctl is-active --quiet usbguard.service; then
+  omarchy-setup-security-usb-authorization --yes
+fi