Quarantine unrecognized policy under the generated sudoers prefix

Matching a legacy grant by its filename and rule relationship is not a
complete fingerprint: the legacy writer took the filename from $USER but
produced the rule with echo, and under BASH_ENV with xpg_echo a name such
as ali\0143e yields an alice rule in a mismatched file. Preserving that
as administrator policy let the migration certify success with an
unrestricted grant still live until the next boot.

The prefix is reserved anyway: boot cleanup and the package hook remove
everything under it. Move any file the classifier does not recognize
into a fresh root-only directory under /var/lib/omarchy/sudoers-quarantine/
as `policy`, with the original name stored beside it, so nothing there
stays live, the administrator keeps the content, and a legacy filename
already close to NAME_MAX still fits. An untrusted quarantine directory
keeps the migration pending. Cover the mismatched and maximum-length
legacy files in the unit cleanup and through the real migration runner.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

bin/omarchy-sudo-passwordless

@@ -29,6 +29,7 @@ readonly BOOT_CLEANUP_FILE=/etc/tmpfiles.d/omarchy-nopasswd-sudo.conf
 readonly PACKAGE_HOOK=/usr/share/libalpm/hooks/05-omarchy-passwordless-revoke.hook
 readonly REMOVAL_BLOCKER=/run/omarchy-sudo-passwordless-package-removing
 readonly MIGRATION_MARKER=/var/lib/omarchy/migrations/1788163635
+readonly QUARANTINE_DIR=/var/lib/omarchy/sudoers-quarantine
 readonly INSTALLED_SELF=/usr/bin/omarchy-sudo-passwordless
 readonly STATUS_INACTIVE=3
 
@@ -143,6 +144,24 @@ cleanup_uid_locked() {
   /usr/bin/rm -f -- "$file" && [[ ! -e $file && ! -L $file ]]
 }
 
+# The generated prefix is reserved: boot cleanup and the package hook already
+# remove everything in it, and the legacy writer could produce a rule whose
+# body differs from its filename. Nothing unrecognized may stay live there, but
+# its content is kept for the administrator instead of being deleted.
+quarantine_foreign_rule() {
+  local file=$1 target
+  if [[ ! -e /var/lib/omarchy && ! -L /var/lib/omarchy ]]; then
+    /usr/bin/install -d -o root -g root -m 0755 -- /var/lib/omarchy || return 1
+  fi
+  omarchy_security_prepare_private_root_directory "$QUARANTINE_DIR" /var/lib/omarchy || return 1
+  # A legacy filename can already be close to NAME_MAX, so the destination
+  # name is fixed and the original name travels beside it.
+  target=$(/usr/bin/mktemp -d "$QUARANTINE_DIR/XXXXXXXXXX") || return 1
+  /usr/bin/printf '%s\n' "${file##*/}" >"$target/name" || return 1
+  /usr/bin/mv -fT -- "$file" "$target/policy" && [[ ! -e $file && ! -L $file ]] || return 1
+  echo "Moved unrecognized sudoers policy $file to $target/policy" >&2
+}
+
 cleanup_all_locked() {
   local file classification failed=0
   verify_root_path /etc/sudoers.d || return 1
@@ -154,7 +173,9 @@ cleanup_all_locked() {
       fi
     else
       classification=$?
-      (( classification == 1 )) || failed=1
+      if (( classification != 1 )) || ! quarantine_foreign_rule "$file"; then
+        failed=1
+      fi
     fi
   done
   return "$failed"