Move install-time plumbing out of the setup namespace

setup is where a user goes to configure something: direct boot, security
keys, hibernation. These three are not that. omarchy-apply-system is the
ISO's entry point in the target chroot, omarchy-apply-hardware is what it
calls for device quirks, and omarchy-apply-lock is called by
install/config/lockscreen-pam.sh.

apply is the verb they already used to describe themselves, and it carries
the contract: declared state under install/ converged onto the machine,
idempotent, safe to repeat.

The group gets no GROUP_DESCRIPTIONS entry on purpose. That table drives the
top-level group list on its own, so an entry would put apply back in front of
users even with every command in it hidden, the way provision already stays
out. A test covers it.

The ISO installs the runtime from the mirror it ships with, so it moves to
the new names in lockstep and no compatibility route is needed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/cli

@@ -182,10 +182,18 @@ if [[ $output == *"omarchy update perform"* ]]; then
 fi
 pass "hidden update perform compatibility wrapper is not shown"
 
-# The setup group is for interactive wizards. These three are install-time
-# plumbing the ISO and install leaves call, so they stay out of the listing a
-# user browses -- while still routing, because those callers use the CLI.
-for internal in omarchy-setup-system omarchy-setup-hardware omarchy-setup-lock; do
+# These three are install-time plumbing the ISO and install leaves call, so
+# they stay out of the listing a user browses -- while still routing, because
+# those callers use the CLI. A GROUP_DESCRIPTIONS entry would put the group
+# back in the top-level listing even with every command in it hidden, which is
+# why apply has none.
+output=$(timeout 5 "$CLI")
+if [[ $output == *"apply"* ]]; then
+  fail "a group whose commands are all hidden stays out of the top-level listing"
+fi
+pass "a group whose commands are all hidden stays out of the top-level listing"
+
+for internal in omarchy-apply-system omarchy-apply-hardware omarchy-apply-lock; do
   if "$CLI" commands --json | jq -e --arg binary "$internal" \
     '.commands[] | select(.binary == $binary)' >/dev/null; then
     fail "$internal stays out of the default command listing"
@@ -197,8 +205,8 @@ for internal in omarchy-setup-system omarchy-setup-hardware omarchy-setup-lock;
 done
 pass "install-time setup plumbing is hidden from the setup wizards"
 
-output=$(timeout 5 "$CLI" setup hardware --help)
-assert_output_contains "hidden setup plumbing still routes" "$output" "omarchy-setup-hardware"
+output=$(timeout 5 "$CLI" apply hardware --help)
+assert_output_contains "hidden setup plumbing still routes" "$output" "omarchy-apply-hardware"
 
 output=$("$CLI" screenshot --help)
 assert_output_contains "root alias resolves to command help" "$output" "omarchy-capture-screenshot"

test/shell.d/snapper-test.sh

@@ -71,7 +71,7 @@ grep -Fx 'systemctl disable --now snapper-timeline.timer' "$test_tmp/calls.log"
 grep -Fx 'systemctl enable --now snapper-cleanup.timer limine-snapper-sync.service' "$test_tmp/calls.log" >/dev/null || fail "snapshot configure enables cleanup and Limine snapshot sync"
 pass "snapshot configure normalizes Snapper policy and services"
 
-setup_system="$ROOT/bin/omarchy-setup-system"
+setup_system="$ROOT/bin/omarchy-apply-system"
 grep -F 'config/all.sh' "$setup_system" >/dev/null ||
   fail "system setup runs the config phase"
 grep -F 'config/snapper.sh' "$ROOT/install/config/all.sh" >/dev/null ||

test/shell.d/upgrade-to-quattro-test.sh

@@ -64,7 +64,7 @@ pass "Omarchy 4 upgrade normalizes Snapper retention"
 
 grep -F 'configure_lock_authentication' "$upgrade_to_quattro" >/dev/null
 grep -F 'OMARCHY_INSTALL_USER="$target_user"' "$upgrade_to_quattro" >/dev/null
-grep -F '"$setup_lock"' "$upgrade_to_quattro" >/dev/null
+grep -F '"$apply_lock"' "$upgrade_to_quattro" >/dev/null
 pass "Omarchy 4 upgrade configures lock screen authentication for the target user"
 
 grep -F 'OMARCHY_UPGRADE_TO_QUATTRO_LIVE=1' "$upgrade_to_quattro" >/dev/null