♻️ refactor(pacman): render regional config without root

- 🔒 upstream refresh now gives root only command-scoped copies, so regional files are rendered as the caller and installed with the same four `sudo cp` calls
- ✅ exercise refresh only inside the sudo-boundary sandbox; the old host-level test reached real sudo once refresh pinned its PATH

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bin/omarchy-apply-pacman

@@ -1,18 +1,33 @@
 #!/bin/bash
 
 # omarchy:summary=Restore channel and regional pacman defaults in an installed target
-# omarchy:args=<stable|rc|edge> [target-root]
+# omarchy:args=<stable|rc|edge> [target-root] | --render <stable|rc|edge> <output-dir> [target-root]
 # omarchy:requires-sudo=true
 # omarchy:hidden=true
 
 set -euo pipefail
 
-if (( $# < 1 || $# > 2 )); then
+usage() {
   echo "Usage: omarchy-apply-pacman <stable|rc|edge> [target-root]" >&2
+  echo "       omarchy-apply-pacman --render <stable|rc|edge> <output-dir> [target-root]" >&2
   exit 1
+}
+
+# --render only builds the two files, so an unprivileged caller can hand root
+# nothing but plain copies of the finished result.
+render_dir=""
+if [[ ${1:-} == "--render" ]]; then
+  (( $# == 3 || $# == 4 )) || usage
+  channel="$2"
+  render_dir="$3"
+  [[ -d $render_dir ]] || { echo "Render directory not found: $render_dir" >&2; exit 1; }
+  etc="${4:-/}/etc"
+else
+  (( $# >= 1 && $# <= 2 )) || usage
+  channel="$1"
+  etc="${2:-/}/etc"
 fi
 
-channel="$1"
 case "$channel" in
   stable|rc|edge) ;;
   *) echo "Invalid pacman channel: $channel" >&2; exit 1 ;;
@@ -20,7 +35,6 @@ esac
 
 # The ISO writes this plain-text marker before target finalization. Missing
 # markers keep existing installations global; never source it as shell code.
-etc="${2:-/}/etc"
 region=global
 if [[ -e $etc/omarchy/region ]]; then
   region=$(<"$etc/omarchy/region")
@@ -32,8 +46,12 @@ esac
 
 # Build both files before replacing either. Explicit refreshes retain backups;
 # ordinary updates do not call this command or enforce regional defaults.
-staging=$(mktemp -d)
-trap 'rm -rf "$staging"' EXIT
+if [[ -n $render_dir ]]; then
+  staging="$render_dir"
+else
+  staging=$(mktemp -d)
+  trap 'rm -rf "$staging"' EXIT
+fi
 cp "$OMARCHY_PATH/default/pacman/pacman-$channel.conf" "$staging/pacman.conf"
 cp "$OMARCHY_PATH/default/pacman/mirrorlist-$channel" "$staging/mirrorlist"
 if [[ $region != "global" ]]; then
@@ -42,6 +60,7 @@ if [[ $region != "global" ]]; then
   cat "$profile/pacman.conf.append" >> "$staging/pacman.conf"
   cat "$profile/mirrorlist.append" >> "$staging/mirrorlist"
 fi
+[[ -z $render_dir ]] || exit 0
 
 mkdir -p "$etc/pacman.d"
 for file in pacman.conf pacman.d/mirrorlist; do

bin/omarchy-refresh-pacman

@@ -30,10 +30,17 @@ if [[ $channel != "stable" && $channel != "rc" && $channel != "edge" ]]; then
   exit 2
 fi
 
+# Render the channel templates plus this machine's regional additions as the
+# caller, so root only copies finished files.
+rendered=$(mktemp -d)
+"$OMARCHY_PATH/bin/omarchy-apply-pacman" --render "$channel" "$rendered"
+
+sudo cp -f /etc/pacman.conf /etc/pacman.conf.bak
+sudo cp -f /etc/pacman.d/mirrorlist /etc/pacman.d/mirrorlist.bak
 echo "Setting channel to $channel"
-# Restores the channel templates plus this machine's regional additions, and
-# backs up both files first. OMARCHY_PATH was verified as this command's root.
-sudo env "OMARCHY_PATH=$OMARCHY_PATH" "$OMARCHY_PATH/bin/omarchy-apply-pacman" "$channel"
+sudo cp -f "$rendered/pacman.conf" /etc/pacman.conf
+sudo cp -f "$rendered/mirrorlist" /etc/pacman.d/mirrorlist
+rm -rf "$rendered"
 
 # Allow user customization of /etc/pacman.conf before the upgrade runs, so
 # custom repositories and IgnorePkg entries shape the downgrade-capable