Address privileged cleanup review findings

bin/omarchy-dns

@@ -149,9 +149,9 @@ write_networkmanager_dns() {
   local servers="$1"
 
   install -d -m 0755 "$(dirname "$NM_DNS_CONF")"
-  # omarchy:heredoc-expands paths=none -- $servers is a space-separated list of
-  # validated DNS server addresses, not a path; nothing user-writable is baked
-  # into the root-owned drop-in.
+  # omarchy:heredoc-expands paths=none -- $servers is a normalized, single-line
+  # DNS server list written as data, not a path or command; nothing user-writable
+  # is resolved or executed from the root-owned drop-in.
   cat >"$NM_DNS_CONF" <<EOF
 # Managed by omarchy-dns. Remove this file or run omarchy dns DHCP to use DHCP DNS again.
 [global-dns]
@@ -305,9 +305,9 @@ Custom)
   split_dns_servers "$dns_servers"
   write_networkmanager_dns "$dns_servers"
   set_connection_dns "$ipv4_dns" "$ipv6_dns"
-  # omarchy:heredoc-expands paths=none -- $dns_servers holds DNS addresses that
-  # normalize_servers has already validated; the //,/ turns the comma list into
-  # the space list resolved.conf wants. No path is interpolated.
+  # omarchy:heredoc-expands paths=none -- $dns_servers is a normalized,
+  # single-line DNS server list; the //,/ turns its comma separators into the
+  # spaces resolved.conf wants. It is written as data, not a path or command.
   tee /etc/systemd/resolved.conf >/dev/null <<EOF
 [Resolve]
 DNS=${dns_servers//,/ }

bin/omarchy-migrate

@@ -85,18 +85,30 @@ wait_for_pacman_transaction
 mkdir -p "$STATE_DIR"
 [[ -d $MIGRATIONS_DIR ]] || exit 0
 
+deferred=()
 while IFS=$'\t' read -r name file marker; do
   [[ -n $name ]] || continue
 
   if [[ ! -f $marker ]]; then
     echo -e "\e[32m\nRunning migration (${name%.sh})\e[0m"
-    OMARCHY_PATH="$OMARCHY_PATH" bash -euo pipefail "$file"
-    mkdir -p "$(dirname "$marker")"
-    touch "$marker"
+    if OMARCHY_PATH="$OMARCHY_PATH" bash -euo pipefail "$file"; then
+      mkdir -p "$(dirname "$marker")"
+      touch "$marker"
+    else
+      migration_status=$?
+      if (( migration_status == 75 )); then
+        deferred+=("$name")
+        echo "Migration ${name%.sh} was deferred and will be retried later."
+      else
+        exit "$migration_status"
+      fi
+    fi
   fi
 done < <(migration_entries)
 
 # Clear a login-time notification the user left sitting there and then resolved
 # by running migrations some other way. The substring matches both the current
 # and legacy notification titles.
-omarchy-notification-dismiss "Omarchy Migrations" >/dev/null 2>&1 || true
+if ((${#deferred[@]} == 0)); then
+  omarchy-notification-dismiss "Omarchy Migrations" >/dev/null 2>&1 || true
+fi