Harden privileged cleanup review fixes

test/shell.d/fixtures/privileged-heredoc/annotated-special-parameter-before-home.sh

@@ -0,0 +1,5 @@
+# omarchy:heredoc-expands paths=none -- the positional argument is a scalar
+sudo tee /etc/omarchy/example.conf <<EOF
+argument=$1
+command=$HOME/.local/share/omarchy/bin/example
+EOF

test/shell.d/fixtures/privileged-heredoc/route-continued-pipeline.sh

@@ -0,0 +1,4 @@
+cat <<EOF |
+command=$HOME/.local/share/omarchy/bin/example
+EOF
+  sudo tee /etc/omarchy/example.conf

test/shell.d/fixtures/privileged-heredoc/route-install-hop-alias.sh

@@ -0,0 +1,6 @@
+tmp=/tmp/omarchy-generated
+copy=$tmp
+cat >"$tmp" <<EOF
+command=$HOME/.local/share/omarchy/bin/example
+EOF
+sudo install -m644 "$copy" /etc/omarchy/example.conf

test/shell.d/fixtures/privileged-heredoc/route-install-hop-braced.sh

@@ -0,0 +1,5 @@
+tmp=/tmp/omarchy-generated
+cat >"$tmp" <<EOF
+command=$HOME/.local/share/omarchy/bin/example
+EOF
+sudo install -m644 "${tmp}" /etc/omarchy/example.conf