Stop world-writable browser policy directories

Chromium managed policy is mandatory for every profile. World-writable
dirs let any local uid plant policy, including force-installed
extensions. Write goes through the omarchy-browser-policy group at 2775
so theme colour still works without other-write.

bin/omarchy-theme-set-browser

@@ -13,11 +13,10 @@ else
   THEME_HEX_COLOR="#1c2027"
 fi
 
-set_browser_policy() {
-  local policy_dir="$1"
+source "$OMARCHY_PATH/install/helpers/browser-policy.sh"
 
-  [[ -d $policy_dir ]] || return
-  echo "{\"BrowserThemeColor\": \"$THEME_HEX_COLOR\", \"BrowserColorScheme\": \"device\"}" | tee "$policy_dir/color.json" >/dev/null
+set_browser_policy() {
+  browser_policy_write_color "$1" "$THEME_HEX_COLOR"
 }
 
 refresh_running_browser() {
@@ -30,17 +29,20 @@ refresh_running_browser() {
   fi
 }
 
-set_browser_policy /etc/chromium/policies/managed
+failed=0
+set_browser_policy /etc/chromium/policies/managed || failed=1
 refresh_running_browser chromium chromium
 
-set_browser_policy /etc/opt/chrome/policies/managed
+set_browser_policy /etc/opt/chrome/policies/managed || failed=1
 refresh_running_browser chrome google-chrome-stable || refresh_running_browser chrome google-chrome
 
-set_browser_policy /etc/opt/edge/policies/managed
+set_browser_policy /etc/opt/edge/policies/managed || failed=1
 refresh_running_browser msedge microsoft-edge-stable
 
-set_browser_policy /etc/brave/policies/managed
+set_browser_policy /etc/brave/policies/managed || failed=1
 refresh_running_browser brave brave
 # Match on the binary path: the running process is named plain "brave", and a
 # bare -f brave-origin pattern would also match the installer's own terminal.
 refresh_running_browser /opt/brave-origin-bin/ brave-origin -f
+
+exit "$failed"