App installs route first-time updates through omarchy-update

Direct pacman -Syu trips the update pacman guard once real upgrades
exist; the catalog installer now runs the upstream update pipeline
interactively and fails fast with instructions when non-interactive.
omarchy-cn-kimi-install gains its executable bit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QKxGW1raAWaqeU8WdHsMsp

bin/omarchy-cn-app-install

@@ -32,10 +32,15 @@ fi
 
 case "$source_type" in
 aur)
-  # Offline installs ship no sync db; yay then treats repo deps as AUR
+  # Offline installs ship no sync db; yay then treats repo deps as AUR.
+  # System upgrades must go through the omarchy-update pipeline (pacman guard).
   if ! compgen -G "/var/lib/pacman/sync/*.db" > /dev/null; then
-    echo "首次安装：正在同步软件仓库并更新系统（pacman -Syu）……"
-    sudo pacman -Syu --noconfirm
+    if [[ ! -t 0 ]]; then
+      echo "首次安装应用前请先完成一次系统更新: omarchy-update" >&2
+      exit 1
+    fi
+    echo "首次安装应用前需要完成一次系统更新。"
+    omarchy-update
   fi
   omarchy-pkg-aur-add "$(jq -r '.package' <<<"$entry")"
   ;;