Match only active include lines when deciding polkit-1 is already fixed

The layout check skips comments, but the already-fixed check matched `include system-auth` anywhere on a line, so a comment such as `# auth include system-auth` made the migration skip a stack that still listed bare pam_unix, and it was marked complete with the lockout still missing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

migrations/1788256455.sh

@@ -29,7 +29,7 @@ is_omarchy_vulnerable_stack() {
   local phase
 
   # Already fixed, or partially converted: leave it alone (also makes reruns no-op).
-  if grep -qE '(auth|account|password|session)[[:space:]]+include[[:space:]]+system-auth' "$file"; then
+  if grep -qE '^(auth|account|password|session)[[:space:]]+include[[:space:]]+system-auth' "$file"; then
     return 1
   fi