Fully revert USB and Thunderbolt device approval (#15091)

* Revert "Merge pull request #11874 from acrogenesis/feature/usb-device-authorization"

This reverts commit 5cb31317b4, reversing
changes made to 9d48fc402e.

* Undo USB and Thunderbolt device approval on machines that ran it

* Verify boot rebuilds, recover Thunderbolt journals and prove USBGuard ownership in the removal migration

* Read the boot partition from ESP_PATH and stop on failed Bolt reads in the removal migration

* Recover Bolt's original mode from the setup journal in the removal migration

etc/polkit-1/rules.d/40-omarchy-thunderbolt.rules

@@ -1,17 +0,0 @@
-polkit.addRule(function(action, subject) {
-  if (action.id === "org.omarchy.thunderbolt.approve" &&
-      subject.active && subject.local && subject.isInGroup("wheel")) {
-    return polkit.Result.YES;
-  }
-  // Bolt's vendor rule grants wheel passwordless management, including enabling
-  // automatic approval of every IOMMU device. Keep blanket policy changes behind
-  // administrator authentication; the narrow Omarchy action approves one device.
-  if (action.id === "org.freedesktop.bolt.manage" && subject.user !== "root") {
-    try {
-      polkit.spawn(["/usr/bin/test", "-f", "/etc/omarchy/thunderbolt-authorization.enabled"]);
-      return polkit.Result.AUTH_ADMIN;
-    } catch (error) {
-      // Protection is disabled: retain the packaged Bolt permission rules.
-    }
-  }
-});

etc/polkit-1/rules.d/40-omarchy-usb.rules

@@ -1,6 +0,0 @@
-polkit.addRule(function(action, subject) {
-  if (action.id === "org.omarchy.usb.approve" &&
-      subject.active && subject.local && subject.isInGroup("wheel")) {
-    return polkit.Result.YES;
-  }
-});

etc/systemd/system/bolt.service.d/omarchy-authorization.conf

@@ -1,3 +0,0 @@
-[Service]
-# Runs before Bolt enumerates hardware, including D-Bus/udev activation.
-ExecStartPre=/usr/bin/omarchy-thunderbolt-authorization-admin guard

etc/systemd/system/omarchy-thunderbolt-authorization.service

@@ -1,26 +0,0 @@
-[Unit]
-Description=Restore approved Thunderbolt devices and handle new approvals
-Wants=bolt.service
-After=bolt.service polkit.service
-ConditionPathExists=/etc/omarchy/thunderbolt-authorization.enabled
-
-[Service]
-Type=simple
-ExecStart=/usr/bin/omarchy-thunderbolt-authorization-daemon
-RuntimeDirectory=omarchy-thunderbolt-authorization
-RuntimeDirectoryMode=0755
-Restart=on-failure
-RestartSec=2
-UMask=0077
-NoNewPrivileges=yes
-ProtectSystem=strict
-ReadWritePaths=/var/lib/omarchy/thunderbolt-authorization /run/lock
-ProtectHome=yes
-PrivateTmp=yes
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-RestrictAddressFamilies=AF_UNIX
-
-[Install]
-WantedBy=multi-user.target