Hide install-time setup plumbing from the command listing

The setup group is described as interactive setup wizards, but these three
are not that. omarchy-setup-system is the ISO's entry point in the target
chroot, omarchy-setup-hardware is what it calls for device quirks, and
omarchy-setup-lock is called by install/config/lockscreen-pam.sh. None of
them is something to browse to and run.

Hiding only affects listings, so the ISO and the install leaves keep routing
through the CLI exactly as before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/cli

@@ -182,6 +182,24 @@ if [[ $output == *"omarchy update perform"* ]]; then
 fi
 pass "hidden update perform compatibility wrapper is not shown"
 
+# The setup group is for interactive wizards. These three are install-time
+# plumbing the ISO and install leaves call, so they stay out of the listing a
+# user browses -- while still routing, because those callers use the CLI.
+for internal in omarchy-setup-system omarchy-setup-hardware omarchy-setup-lock; do
+  if "$CLI" commands --json | jq -e --arg binary "$internal" \
+    '.commands[] | select(.binary == $binary)' >/dev/null; then
+    fail "$internal stays out of the default command listing"
+  fi
+
+  "$CLI" commands --all --json | jq -e --arg binary "$internal" \
+    '.commands[] | select(.binary == $binary) | select(.hidden)' >/dev/null ||
+    fail "$internal is still listed by commands --all"
+done
+pass "install-time setup plumbing is hidden from the setup wizards"
+
+output=$(timeout 5 "$CLI" setup hardware --help)
+assert_output_contains "hidden setup plumbing still routes" "$output" "omarchy-setup-hardware"
+
 output=$("$CLI" screenshot --help)
 assert_output_contains "root alias resolves to command help" "$output" "omarchy-capture-screenshot"