# omarchy-sudo-passwordless writes /etc/sudoers.d/99-omarchy-nopasswd-<user> and
# arms a transient systemd-run timer to remove it again. Transient units do not
# survive a reboot, so remove any remaining grant during early boot. Boot-only
# (r!) ensures a later systemd-tmpfiles --remove cannot cut a live grant short.
r! /etc/sudoers.d/99-omarchy-nopasswd-*