Fully revert USB and Thunderbolt device approval (#15091)

* Revert "Merge pull request #11874 from acrogenesis/feature/usb-device-authorization"

This reverts commit 5cb31317b4, reversing
changes made to 9d48fc402e.

* Undo USB and Thunderbolt device approval on machines that ran it

* Verify boot rebuilds, recover Thunderbolt journals and prove USBGuard ownership in the removal migration

* Read the boot partition from ESP_PATH and stop on failed Bolt reads in the removal migration

* Recover Bolt's original mode from the setup journal in the removal migration

install/config/all.sh

@@ -8,7 +8,5 @@ run_logged "$OMARCHY_INSTALL/config/ssh-keepalive.sh"
 run_logged "$OMARCHY_INSTALL/config/docker.sh"
 run_logged "$OMARCHY_INSTALL/config/locale.sh"
 run_logged "$OMARCHY_INSTALL/config/snapper.sh"
-run_logged "$OMARCHY_INSTALL/config/usb-authorization.sh"
 run_logged "$OMARCHY_INSTALL/config/enable-services.sh"
 run_logged "$OMARCHY_INSTALL/config/firewall.sh"
-run_logged "$OMARCHY_INSTALL/config/thunderbolt-authorization.sh"

install/config/thunderbolt-authorization.sh

@@ -1,10 +0,0 @@
-echo "Configure Thunderbolt device authorization"
-
-install -Dm644 "$OMARCHY_PATH/default/polkit/org.omarchy.thunderbolt.policy" /usr/share/polkit-1/actions/org.omarchy.thunderbolt.policy
-
-# The builder's accessories must not become the new owner's trust policy.
-# Keep ordinary Bolt behavior until interactive owner setup has finished.
-if [[ -n ${OMARCHY_INSTALL_USER:-} ]]; then
-  /usr/bin/omarchy-thunderbolt-authorization-admin prepare
-  systemctl enable omarchy-thunderbolt-authorization.service
-fi

install/config/usb-authorization.sh

@@ -1,26 +0,0 @@
-echo "Configure USB device authorization"
-
-install -Dm644 "$OMARCHY_PATH/default/polkit/org.omarchy.usb.policy" /usr/share/polkit-1/actions/org.omarchy.usb.policy
-
-# A deferred install has only the builder's peripherals attached. The owner
-# needs working input before there is an account or a session for approvals.
-if [[ -z ${OMARCHY_INSTALL_USER:-} ]]; then
-  systemctl disable usbguard.service
-  return 0
-fi
-
-rules_file="${OMARCHY_USB_AUTHORIZATION_RULES_FILE:-/etc/usbguard/rules.conf}"
-daemon_config="${OMARCHY_USB_AUTHORIZATION_DAEMON_CONFIG:-/etc/usbguard/usbguard-daemon.conf}"
-
-source "$OMARCHY_INSTALL/helpers/usb-authorization.sh"
-usb_authorization_require_secure_settings "$daemon_config"
-
-if [[ ! -s $rules_file ]]; then
-  usb_authorization_install_policy "$rules_file"
-fi
-
-usb_authorization_add_user "$OMARCHY_INSTALL_USER"
-
-# Installs are followed by a reboot, so enable the daemon without starting it
-# in the live ISO's chroot.
-systemctl enable usbguard.service