Let the invitation terminals actually open

Clicking the Voxtype or fingerprint invitation did nothing. The launcher
execs setsid, which forks because the transient unit's main process is
already a process group leader, so the unit exits within milliseconds and
systemd's default control-group kill took the still-starting terminal down
with it. Run those units with KillMode=process instead.

The invitation tests had also drifted from the two-unit design and were
failing; teach the systemd-run mock to run the command it is given.

test/shell.d/fingerprint-invitation-test.sh

@@ -45,10 +45,13 @@ cat >"$test_bin/systemd-run" <<'EOF'
 #!/bin/bash
 echo "systemd-run:$*" >>"$TEST_LOG"
 while (($# > 0)); do
-  [[ $1 == "bash" ]] && exec "$@"
-  shift
+  case $1 in
+    -p) shift 2 ;;
+    -*) shift ;;
+    *) break ;;
+  esac
 done
-exit 1
+exec "$@"
 EOF
 chmod +x "$test_bin/systemd-run"
 
@@ -67,14 +70,17 @@ run_invitation_hook
 
 [[ -f $test_home/.local/state/omarchy/done/fingerprint-setup-invitation ]] || fail "fingerprint invitation records completion"
 [[ -f $hook_path ]] || fail "fingerprint invitation keeps its hook installed"
-[[ $(grep -c '^systemd-run:' "$log_file") -eq 1 ]] || fail "fingerprint invitation uses a durable user service"
+[[ $(grep -c '^systemd-run:' "$log_file") -eq 2 ]] || fail "fingerprint invitation uses durable user services"
 grep -q -- '--user --collect --quiet --service-type=exec --unit=omarchy-fingerprint-setup-invitation' "$log_file" || fail "fingerprint invitation configures its user service"
+# KillMode=process keeps the launcher's setsid child alive once the short-lived
+# main process exits, otherwise the setup terminal never appears.
+grep -q -- '--user --collect --quiet -p KillMode=process --unit=omarchy-setup-security-fingerprint ' "$log_file" || fail "fingerprint invitation outlives its launcher unit"
 [[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "fingerprint invitation sends one notification"
 [[ $(grep -c '^launch$' "$log_file") -eq 1 ]] || fail "fingerprint invitation handles the notification action"
 
 HOME="$test_home" PATH="$test_bin:$ROOT/bin:$PATH" TEST_LOG="$log_file" TEST_HW_MARKER="$hw_marker" bash "$hook_path"
 
-[[ $(grep -c '^systemd-run:' "$log_file") -eq 1 ]] || fail "completed fingerprint invitation does not schedule again"
+[[ $(grep -c '^systemd-run:' "$log_file") -eq 2 ]] || fail "completed fingerprint invitation does not schedule again"
 [[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "completed fingerprint invitation hook does not notify again"
 
 pass "fingerprint invitation waits for a reader and only runs once"

test/shell.d/voxtype-invitation-test.sh

@@ -32,10 +32,13 @@ cat >"$test_bin/systemd-run" <<'EOF'
 #!/bin/bash
 echo "systemd-run:$*" >>"$TEST_LOG"
 while (($# > 0)); do
-  [[ $1 == "bash" ]] && exec "$@"
-  shift
+  case $1 in
+    -p) shift 2 ;;
+    -*) shift ;;
+    *) break ;;
+  esac
 done
-exit 1
+exec "$@"
 EOF
 chmod +x "$test_bin/systemd-run"
 
@@ -48,15 +51,18 @@ run_invitation_hook
 
 [[ -f $test_home/.local/state/omarchy/done/voxtype-install-invitation ]] || fail "Voxtype invitation records completion"
 [[ -f $hook_path ]] || fail "Voxtype invitation keeps its hook installed"
-[[ $(grep -c '^systemd-run:' "$log_file") -eq 1 ]] || fail "Voxtype invitation uses a durable user service"
+[[ $(grep -c '^systemd-run:' "$log_file") -eq 2 ]] || fail "Voxtype invitation uses durable user services"
 grep -q -- '--user --collect --quiet --service-type=exec --unit=omarchy-voxtype-install-invitation' "$log_file" || fail "Voxtype invitation configures its user service"
+# KillMode=process keeps the launcher's setsid child alive once the short-lived
+# main process exits, otherwise the install terminal never appears.
+grep -q -- '--user --collect --quiet -p KillMode=process --unit=omarchy-voxtype-install ' "$log_file" || fail "Voxtype invitation outlives its launcher unit"
 [[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "Voxtype invitation sends one notification"
 [[ $(grep -c '^launch$' "$log_file") -eq 1 ]] || fail "Voxtype invitation handles the notification action"
 
 HOME="$test_home" PATH="$test_bin:$ROOT/bin:$PATH" TEST_LOG="$log_file" bash "$hook_path"
 
 [[ -f $hook_path ]] || fail "completed Voxtype invitation keeps its hook installed"
-[[ $(grep -c '^systemd-run:' "$log_file") -eq 1 ]] || fail "completed Voxtype invitation does not schedule again"
+[[ $(grep -c '^systemd-run:' "$log_file") -eq 2 ]] || fail "completed Voxtype invitation does not schedule again"
 [[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "completed Voxtype invitation hook does not notify again"
 [[ $(grep -c '^launch$' "$log_file") -eq 1 ]] || fail "completed Voxtype invitation hook does not launch again"