Prevent empty drive encryption passwords (#6306)

* Prevent empty drive encryption passwords

* Use sudo, quote the confirmation compare, and cover mismatches in test

The unquoted [[ $new_password == $confirmation ]] made the confirmation
a glob pattern, so a confirmation like * matched any password. And pkexec
brought nothing over the repo-standard sudo here while failing outright
in sessions without a polkit agent.

Verified against a loopback LUKS device: new key lands from stdin without
a trailing newline while the current passphrase is prompted on the tty.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: mplaczek99 <mplaczek99@gmail.com>
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

bin/omarchy-drive-password

@@ -13,8 +13,16 @@ if [[ -n $encrypted_drives ]]; then
   fi
 
   if [[ -n $drive_to_change ]]; then
+    new_password=$(gum input --password --header "New encryption password") || exit 1
+    [[ -n $new_password ]] || { echo "Password cannot be empty."; exit 1; }
+
+    confirmation=$(gum input --password --header "Confirm new encryption password") || exit 1
+    [[ $new_password == "$confirmation" ]] || { echo "Passwords do not match."; exit 1; }
+
     echo "Changing full-disk encryption password for $drive_to_change"
-    sudo cryptsetup luksChangeKey --pbkdf argon2id --iter-time 2000 "$drive_to_change"
+    # The new key travels over stdin and reaches cryptsetup as a keyfile via
+    # <(cat), leaving the tty free for the current-passphrase prompt.
+    printf "%s" "$new_password" | sudo bash -c 'exec cryptsetup luksChangeKey --pbkdf argon2id --iter-time 2000 "$1" <(cat) </dev/tty' bash "$drive_to_change"
   else
     echo "No drive selected."
   fi