Write browser theme colour through a passwordless helper

Managed policy dirs are enterprise trust roots, so they stay 0755 root:root. The menu path takes root for that one write through a sudoers glob of six hex digits, the same shape as omarchy-dns, and falls back to pkexec where the grant is not installed. Drop omarchy-browser-policy; a group member could plant any JSON, not just a colour.

bin/omarchy-provision-owner

@@ -744,11 +744,8 @@ create_user() {
   chmod 440 /etc/sudoers.d/00-omarchy-wheel
 
   source "$OMARCHY_PATH/install/helpers/browser-policy.sh"
-  OMARCHY_INSTALL_USER=$username
-  OMARCHY_PROVISIONING_DIR=$PROVISIONING_DIR
-  browser_policy_setup_group
   for dir in "${BROWSER_POLICY_MANAGED_DIRS[@]}"; do
-    [[ -d $dir ]] || continue
+    [[ -d $dir || -L $dir ]] || continue
     browser_policy_setup_dir "$dir"
   done
 }