Close three paths from an unprivileged session to root

Apply the Omabot patch on Quattro, verify effective SSH hardening, prevent stored provisioning state from restoring the blanket input-group grant, and stop Omarchy from shipping asdcontrol authorization that belongs to the package.

Co-authored-by: David Heinemeier Hansson <david@hey.com>

migrations/1787865477.sh

@@ -0,0 +1,18 @@
+echo "Drop the default input group grant, which allowed unprivileged keylogging"
+
+# Membership of `input` gives raw read/write access to /dev/input/event*: any
+# process running as the user can capture keystrokes and synthesize input. The
+# blanket grant is unnecessary: the Xbox-controller and ydotool installers add
+# the group themselves when those features are deliberately installed.
+#
+# Preserve membership where one of those opt-in features is present; removing
+# it there would break the feature the user chose to install.
+if id -nG "$USER" | grep -qw input; then
+  if pacman -Qq xpadneo-dkms &>/dev/null || pacman -Qq ydotool &>/dev/null; then
+    echo "Keeping $USER in the input group: controller or ydotool support is installed."
+  else
+    sudo gpasswd -d "$USER" input >/dev/null
+    echo "Removed $USER from the input group. Log out and back in to apply."
+    omarchy-state set reboot-required
+  fi
+fi