Harden privileged cleanup review fixes

bin/omarchy-migrate

@@ -91,18 +91,28 @@ while IFS=$'\t' read -r name file marker; do
 
   if [[ ! -f $marker ]]; then
     echo -e "\e[32m\nRunning migration (${name%.sh})\e[0m"
-    if OMARCHY_PATH="$OMARCHY_PATH" bash -euo pipefail "$file"; then
+    defer_file=$(mktemp "$STATE_DIR/.defer.XXXXXX")
+    defer_token="$BASHPID-$RANDOM-$RANDOM"
+    migration_status=0
+
+    if OMARCHY_PATH="$OMARCHY_PATH" \
+      OMARCHY_MIGRATION_DEFER_FILE="$defer_file" \
+      OMARCHY_MIGRATION_DEFER_TOKEN="$defer_token" \
+      bash -euo pipefail "$file"; then
       mkdir -p "$(dirname "$marker")"
       touch "$marker"
     else
       migration_status=$?
-      if (( migration_status == 75 )); then
+      if (( migration_status == 75 )) && [[ $(<"$defer_file") == "$defer_token" ]]; then
         deferred+=("$name")
         echo "Migration ${name%.sh} was deferred and will be retried later."
       else
+        rm -f "$defer_file"
         exit "$migration_status"
       fi
     fi
+
+    rm -f "$defer_file"
   fi
 done < <(migration_entries)
 

bin/omarchy-provision-owner

@@ -788,7 +788,7 @@ configure_login() {
 # After=) is what makes it deterministic — no sleep/race against SDDM's startup.
 install_autologin_once_cleanup() {
   local unit=omarchy-provision-autologin-once.service
-  cat >"/etc/systemd/system/$unit" <<'UNIT'
+  sed "s|@UNIT@|$unit|g" >"/etc/systemd/system/$unit" <<'UNIT'
 [Unit]
 Description=Drop the first-boot autologin before the next login
 Before=display-manager.service
@@ -797,7 +797,7 @@ ConditionPathExists=/etc/sddm.conf.d/autologin.conf
 [Service]
 Type=oneshot
 ExecStart=/usr/bin/rm -f /etc/sddm.conf.d/autologin.conf
-ExecStartPost=/usr/bin/rm -f /etc/systemd/system/graphical.target.wants/omarchy-provision-autologin-once.service /etc/systemd/system/omarchy-provision-autologin-once.service
+ExecStartPost=/usr/bin/rm -f /etc/systemd/system/graphical.target.wants/@UNIT@ /etc/systemd/system/@UNIT@
 
 [Install]
 WantedBy=graphical.target