Write browser theme colour through a passwordless helper

Managed policy dirs are enterprise trust roots, so they stay 0755 root:root. The menu path takes root for that one write through a sudoers glob of six hex digits, the same shape as omarchy-dns, and falls back to pkexec where the grant is not installed. Drop omarchy-browser-policy; a group member could plant any JSON, not just a colour.

bin/omarchy-install-browser

@@ -9,8 +9,6 @@ set -e
 source "$OMARCHY_PATH/install/helpers/browser-policy.sh"
 
 setup_chromium_policy_directory() {
-  browser_policy_setup_group
-  browser_policy_grant_user "${USER:-$(id -un)}"
   browser_policy_setup_dir "$1"
 }