Mirrors the upstream tightening in install/config/timezones.sh (which this etc-overrides file replaced): scope the wheel passwordless rule to 'timedatectl set-timezone *' instead of the whole timedatectl, so the rule can't be used to flip other system clock settings. Adopted while rebasing onto current origin/omarchy-shell.