Close three paths from an unprivileged session to root

Apply the Omabot patch on Quattro, verify effective SSH hardening, prevent stored provisioning state from restoring the blanket input-group grant, and stop Omarchy from shipping asdcontrol authorization that belongs to the package.

Co-authored-by: David Heinemeier Hansson <david@hey.com>

bin/omarchy-provision-owner

@@ -677,11 +677,15 @@ user_groups() {
   if [[ -f $PROVISIONING_DIR/groups ]]; then
     while IFS= read -r group; do
       [[ -n $group ]] || continue
-      # Never grant docker at first boot, even if an older install recorded it
-      # (or a factory snapshot predating the opt-in default carries it): the
-      # docker group is root-equivalent. It is opt-in via
-      # omarchy-setup-security-sudoless-docker.
+      # Never replay old privileged group defaults. Docker is always opt-in.
+      # Input is only retained when the factory image has one of the features
+      # whose installer deliberately grants access to raw input devices.
       [[ $group == "docker" ]] && continue
+      if [[ $group == "input" ]] &&
+        ! pacman -Qq xpadneo-dkms &>/dev/null &&
+        ! pacman -Qq ydotool &>/dev/null; then
+        continue
+      fi
       getent group "$group" >/dev/null || continue
       [[ ",$groups," == *",$group,"* ]] || groups+=",$group"
     done <"$PROVISIONING_DIR/groups"