Ask for the sudo password once per omarchy update (#13323)

* Ask for the sudo password once per omarchy update

Every sudo call in omarchy update prompted, because the no-update wrapper
covered the whole run on top of per-phase revokes, and stay-awake revoked
the timestamp on its own entry and exit. A single update could ask four
times before the snapshot finished (#13319).

Authorize once, right after confirmation, starting from a revoked
timestamp so the prompt always belongs to this update. A background
keepalive refreshes it until the update is done. Prune, snapshot,
stay-awake, keyring, system packages, migrations, orphan removal, service
restarts, the post-update hook, and mise all share that authorization.

AUR builds run third-party PKGBUILD code, so they move to the end and run
cold: the keepalive stops, the timestamp is revoked, and yay and any bare
sudo use the no-update wrapper. The timestamp is revoked again after AUR
and on every exit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Keep the single authorization for passwordless sudo and ttyless inhibition

Authorize by running a command instead of sudo -v. Under the default
verifypw=all, -v prompts even when passwordless sudo is enabled, which
would have added a prompt those users never had.

Inside an update without a terminal, stay-awake now reuses the update's
authorization with a non-interactive sudo instead of asking again through
polkit. It falls back to polkit only if that authorization is gone.

The test sudo refuses a cold non-interactive call, as the real one does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

test/shell.d/update-user-path-test.sh

@@ -38,8 +38,8 @@ for step in omarchy-hook omarchy-update-mise; do
   rm "$SUDO_TEST_ROOT/bin/$step"
   cat >"$SUDO_TEST_ROOT/bin/$step" <<'STUB'
 #!/bin/bash
-[[ ! -e $SUDO_TEST_CACHE ]] || exit 91
-[[ $(command -v sudo) == "$OMARCHY_PATH/default/omarchy/sudo-no-update/sudo" ]] || exit 92
+[[ -e $SUDO_TEST_CACHE ]] || exit 91
+[[ $(command -v sudo) != "$OMARCHY_PATH/default/omarchy/sudo-no-update/sudo" ]] || exit 92
 update-user-tool "${0##*/}"
 STUB
   chmod +x "$SUDO_TEST_ROOT/bin/$step"
@@ -63,5 +63,5 @@ for entry in fresh logged locked; do
     grep -q '^locked-reexec$' "$SUDO_TEST_LOG" || fail "$entry update did not exercise the lock exec"
   fi
   assert_boundary_cold "$entry update"
-  pass "$entry update preserves the original user PATH through logging and locking with no-update sudo first"
+  pass "$entry update preserves the original user PATH through logging and locking and shares its authorization"
 done