Require a factory snapshot to reset a computer (#6680)

Machines without @factory fell back to a degraded reset that kept the
current system and only wiped user state. Turn them away with an
explanation instead, and drop the degraded staging path.

The first-boot worker still honors a wipe-degraded marker so a reset
staged by an older version finishes its scrub rather than handing the
machine over with the seller's accounts intact.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

bin/omarchy-provision-owner

@@ -939,8 +939,8 @@ reset_limine_config() {
 }
 
 cleanup_oem_state() {
-  # Keep groups + packages: omarchy-system-factory-reset's degraded path (machines
-  # without @factory) re-arms first-boot setup from the live copies.
+  # Keep groups + packages: omarchy-system-factory-reset stages the bundled Node
+  # tarball from these live copies when the factory snapshot predates it.
   rm -f "$PROVISIONING_DIR/pending" "$PROVISIONING_DIR/authorized_keys" "$PROVISIONING_DIR/setup-user"
 
   rm -f /etc/systemd/system/multi-user.target.wants/omarchy-provision-owner.service