Keep channel transitions inside command-scoped sudo

bin/omarchy-channel-set

@@ -1,10 +1,23 @@
-#!/bin/bash
+#!/bin/bash -p
 
 # omarchy:summary=Set the Omarchy package channel.
 # omarchy:args=<stable|rc|edge|dev>
 # omarchy:requires-sudo=true
 
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup for channel switching." >&2
+  exit 126
+fi
+security_entrypoint=$(/usr/bin/readlink -e -- "${BASH_SOURCE[0]}") || exit 126
+source "${security_entrypoint%/*}/omarchy-security-functions" || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
 set -euo pipefail
+omarchy_security_sanitize_bash_environment "$0" "$@"
+omarchy_security_require_source_root "$0"
+user_path=$PATH
+omarchy_security_revoke_sudo_timestamp || exit 1
+omarchy_security_install_sudo_cleanup_traps
+omarchy_security_enable_no_update_sudo
 
 usage() { echo "Usage: omarchy-channel-set [stable|rc|edge|dev]"; }
 fail() { echo "Error: $*" >&2; exit 1; }
@@ -79,7 +92,7 @@ fi
 if [[ -n $dev_checkout ]]; then
   link_dev_checkout "$dev_checkout"
   export OMARCHY_PATH="$dev_checkout"
-  export PATH="$OMARCHY_PATH/bin:$PATH"
+  omarchy_security_enable_no_update_sudo
   omarchy-state set reboot-required
 fi
 
@@ -90,13 +103,16 @@ sudo env OMARCHY_UPDATE_PACMAN=1 pacman -S --needed --noconfirm --ask 4 "${packa
 if [[ -z $dev_checkout ]]; then
   omarchy-dev-unlink --no-reboot
   export OMARCHY_PATH=/usr/share/omarchy
+  omarchy_security_enable_no_update_sudo
 
   if (( leaving_dev )); then
     omarchy-state set reboot-required
   fi
 fi
 
-omarchy-update -y
+OMARCHY_UPDATE_USER_PATH="$user_path" "$OMARCHY_PATH/bin/omarchy-update" -y
 
 # No channel-owned privileged work follows the historical refresh hook.
-omarchy-refresh-pacman "$pacman_channel" run-deferred
+omarchy_security_revoke_sudo_timestamp
+PATH="$OMARCHY_PATH/default/omarchy/sudo-no-update:$user_path" \
+  "$OMARCHY_PATH/bin/omarchy-refresh-pacman" "$pacman_channel" run-deferred