Merge pull request #9467 from AFOliveira/codex/om-sec-12-update-inhibitor-identity

[codex] OM-SEC-12: Bind update inhibitor cleanup to process identity

Reported-by: Afonso "AFOliveira" Oliveira

migrations/1788163635.sh

@@ -0,0 +1,6 @@
+echo "Remove legacy temporary passwordless sudo grants"
+
+# Migration queues are per-user; the privileged repair is once per machine.
+if ! /usr/bin/omarchy-sudo-passwordless __migration-complete; then
+  sudo /usr/bin/omarchy-sudo-passwordless __migrate
+fi