Address privileged cleanup review findings

test/shell.d/fixtures/privileged-heredoc/arithmetic-left-shift-before-heredoc.sh

@@ -0,0 +1,5 @@
+mask=$((1 << bits))
+
+cat >/etc/omarchy/agent.conf <<EOF
+helper=$HOME/.local/share/omarchy/bin/omarchy-agent
+EOF

test/shell.d/fixtures/privileged-heredoc/plain-heredoc-indented-pseudo-delimiter.sh

@@ -0,0 +1,5 @@
+cat >/etc/omarchy/agent.conf <<EOF
+enabled=true
+  EOF
+helper=$HOME/.local/share/omarchy/bin/omarchy-agent
+EOF

test/shell.d/fixtures/privileged-heredoc/route-append-redirect.sh

@@ -0,0 +1,3 @@
+cat >>/etc/omarchy/agent.conf <<EOF
+helper=$HOME/.local/share/omarchy/bin/omarchy-agent
+EOF

test/shell.d/fixtures/privileged-heredoc/safe-annotated-reordered-paths.sh

@@ -0,0 +1,8 @@
+storage="$HOME/storage"
+shared="$HOME/shared"
+
+# omarchy:heredoc-expands paths=shared,storage -- both sources are validated before use
+cat >/etc/omarchy/mounts.conf <<EOF
+storage=$storage:/storage
+shared=$shared:/shared
+EOF