Move install-time plumbing out of the setup namespace

setup is where a user goes to configure something: direct boot, security
keys, hibernation. These three are not that. omarchy-apply-system is the
ISO's entry point in the target chroot, omarchy-apply-hardware is what it
calls for device quirks, and omarchy-apply-lock is called by
install/config/lockscreen-pam.sh.

apply is the verb they already used to describe themselves, and it carries
the contract: declared state under install/ converged onto the machine,
idempotent, safe to repeat.

The group gets no GROUP_DESCRIPTIONS entry on purpose. That table drives the
top-level group list on its own, so an entry would put apply back in front of
users even with every command in it hidden, the way provision already stays
out. A test covers it.

The ISO installs the runtime from the mirror it ships with, so it moves to
the new names in lockstep and no compatibility route is needed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bin/omarchy-apply-hardware

@@ -1,20 +1,20 @@
 #!/bin/bash
 
 # omarchy:summary=Apply Omarchy hardware-specific packages and system configuration
-# omarchy:group=setup
+# omarchy:group=apply
 # omarchy:requires-sudo=true
-# omarchy:examples=omarchy setup hardware --install-user dhh
+# omarchy:examples=omarchy apply hardware --install-user dhh
 # omarchy:hidden=true
 
 set -euo pipefail
 
 usage() {
   cat <<USAGE
-Usage: omarchy setup hardware --install-user USER
-       omarchy setup hardware --defer-provisioning
+Usage: omarchy apply hardware --install-user USER
+       omarchy apply hardware --defer-provisioning
 
 Runs idempotent hardware detection/setup for the installed machine. This is
-called by omarchy-setup-system during ISO finalization and can be rerun later
+called by omarchy-apply-system during ISO finalization and can be rerun later
 for diagnostics or after hardware/package updates.
 
 --defer-provisioning runs without an install user (deferred-provisioning installs create the user at
@@ -47,7 +47,7 @@ while (($#)); do
 done
 
 if (( EUID != 0 )); then
-  echo "Error: omarchy-setup-hardware must run as root" >&2
+  echo "Error: omarchy-apply-hardware must run as root" >&2
   exit 1
 fi
 

bin/omarchy-apply-lock

@@ -1,8 +1,6 @@
 #!/bin/bash
 
 # omarchy:summary=Configure Quickshell lock screen authentication
-# omarchy:group=setup
-# omarchy:name=lock
 # omarchy:requires-sudo=true
 # omarchy:hidden=true
 

bin/omarchy-apply-system

@@ -1,21 +1,21 @@
 #!/bin/bash
 
 # omarchy:summary=Apply Omarchy system setup in the installed target
-# omarchy:group=setup
+# omarchy:group=apply
 # omarchy:requires-sudo=true
-# omarchy:examples=omarchy setup system --install-user dhh --first-install
+# omarchy:examples=omarchy apply system --install-user dhh --first-install
 # omarchy:hidden=true
 
 set -euo pipefail
 
 usage() {
   cat <<USAGE
-Usage: omarchy setup system --install-user USER [--first-install|--upgrade]
-       omarchy setup system --defer-provisioning --first-install
+Usage: omarchy apply system --install-user USER [--first-install|--upgrade]
+       omarchy apply system --defer-provisioning --first-install
 
 Runs root-owned Omarchy system setup. The ISO calls this in the target chroot
 after packages are installed and the target user exists. It also calls
-omarchy-setup-hardware, so hardware setup cannot be accidentally skipped.
+omarchy-apply-hardware, so hardware setup cannot be accidentally skipped.
 
 --defer-provisioning runs without an install user: deferred-provisioning installs create the user at
 first boot, so scripts that grant group memberships record them in
@@ -59,7 +59,7 @@ while (($#)); do
 done
 
 if (( EUID != 0 )); then
-  echo "Error: omarchy-setup-system must run as root" >&2
+  echo "Error: omarchy-apply-system must run as root" >&2
   exit 1
 fi
 
@@ -91,9 +91,9 @@ start_install_log
 source "$OMARCHY_INSTALL/config/all.sh"
 
 if (( defer_provisioning )); then
-  omarchy-setup-hardware --defer-provisioning
+  omarchy-apply-hardware --defer-provisioning
 else
-  omarchy-setup-hardware --install-user "$install_user"
+  omarchy-apply-hardware --install-user "$install_user"
 fi
 
 source "$OMARCHY_INSTALL/login/all.sh"

bin/omarchy-provision-owner

@@ -669,7 +669,7 @@ Timezone,${timezone:-UTC}" |
   gum confirm --negative "No, change it" "Does this look right?"
 }
 
-# Groups recorded by omarchy-setup-system's scripts at install time
+# Groups recorded by omarchy-apply-system's scripts at install time
 # (/var/lib/omarchy/provisioning/groups), filtered to groups that exist on this system.
 user_groups() {
   local groups="wheel" group

bin/omarchy-upgrade-to-quattro

@@ -612,16 +612,16 @@ configure_snapper_policy() {
 }
 
 configure_lock_authentication() {
-  local setup_lock=/usr/share/omarchy/bin/omarchy-setup-lock
+  local apply_lock=/usr/share/omarchy/bin/omarchy-apply-lock
 
-  [[ -x $setup_lock ]] || fail "$setup_lock is unavailable; lock screen authentication could not be configured."
+  [[ -x $apply_lock ]] || fail "$apply_lock is unavailable; lock screen authentication could not be configured."
 
   log "Configuring lock screen authentication"
   as_root env \
     OMARCHY_INSTALL_USER="$target_user" \
     OMARCHY_PATH=/usr/share/omarchy \
     PATH="$package_path" \
-    "$setup_lock"
+    "$apply_lock"
 }
 
 create_pre_upgrade_snapshot() {