Merge pull request #9467 from AFOliveira/codex/om-sec-12-update-inhibitor-identity

[codex] OM-SEC-12: Bind update inhibitor cleanup to process identity

Reported-by: Afonso "AFOliveira" Oliveira

default/omarchy/sudo-no-update/sudo

@@ -0,0 +1,20 @@
+#!/bin/bash -p
+
+# Preserve sudo options while preventing authentication from refreshing the
+# credential cache. Timestamp maintenance and informational modes stand alone.
+if [[ $- != *p* ]]; then
+  echo "Refusing an unsafe Bash startup for the sudo boundary." >&2
+  exit 126
+fi
+security_entrypoint=$(/usr/bin/readlink -e -- "${BASH_SOURCE[0]}") || exit 126
+source "${security_entrypoint%/*}/../../../bin/omarchy-security-functions" || exit 126
+omarchy_security_require_privileged_bash_startup || exit 126
+
+if (( $# == 1 )); then
+  case "$1" in
+    -k|--reset-timestamp|-K|--remove-timestamp|-h|--help|-V|--version)
+      exec /usr/bin/sudo "$@"
+      ;;
+  esac
+fi
+exec /usr/bin/sudo -N "$@"