Simplify passwordless sudo grant lifecycle

migrations/1788163635.sh

@@ -1,6 +1,6 @@
 echo "Remove legacy temporary passwordless sudo grants"
 
-# This removes current numeric grants, exact legacy username grants, corrupt or
-# orphaned state, and their known timers. Administrator-authored sudoers files
-# whose contents do not exactly match Omarchy's generated grammar are preserved.
-sudo /usr/bin/omarchy-sudo-passwordless __cleanup-all
+# Migration queues are per-user; the privileged repair is once per machine.
+if ! /usr/bin/omarchy-sudo-passwordless __migration-complete; then
+  sudo /usr/bin/omarchy-sudo-passwordless __migrate
+fi