Keep the host's region out of the sudo boundary sandboxes

test/shell.d/channel-sudo-boundary-test.sh

@@ -6,7 +6,6 @@ source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
 source "$SHELL_TEST_DIR/fixtures/sudo-boundary-test.sh"
 copy_boundary_file bin/omarchy-channel-set
 copy_boundary_file bin/omarchy-refresh-pacman
-copy_boundary_file bin/omarchy-region
 copy_boundary_file bin/omarchy-update
 export OMARCHY_UPDATE_LOGGED=1
 

test/shell.d/fixtures/sudo-boundary-test.sh

@@ -32,6 +32,9 @@ PY
 copy_boundary_file bin/omarchy-security-functions
 copy_boundary_file bin/omarchy-update-pacman
 copy_boundary_file default/omarchy/sudo-no-update/sudo
+# The host's own region must not leak into the sandbox.
+printf '#!/bin/bash\necho Global\n' >"$SUDO_TEST_ROOT/bin/omarchy-region"
+chmod +x "$SUDO_TEST_ROOT/bin/omarchy-region"
 
 cat >"$SUDO_TEST_ROOT/mock/sudo" <<'STUB'
 #!/bin/bash

test/shell.d/update-hook-security-test.sh

@@ -6,7 +6,6 @@ source "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/base-test.sh"
 source "$SHELL_TEST_DIR/fixtures/sudo-boundary-test.sh"
 copy_boundary_file bin/omarchy-update
 copy_boundary_file bin/omarchy-refresh-pacman
-copy_boundary_file bin/omarchy-region
 # Replace the step symlink, preserving the real fixture dispatcher.
 rm "$SUDO_TEST_ROOT/bin/omarchy-update-aur-pkgs"
 copy_boundary_file bin/omarchy-update-aur-pkgs