[codex] Revoke passwordless grants when settings is removed

[AFOliveira]

Settings owns the complete temporary sudo-grant lifecycle: publication helper, shared security library, boot cleanup and an aborting pre-transaction revocation hook. Removing only the desktop runtime preserves expiry support; upgrading or removing settings revokes the grant before those files disappear.

The hook and grant publication share one lock and a package-transition marker. Revocation failure aborts the ALPM transaction and blocks new grants until a successful retry. Scriptlets retain the legacy fallback for the first upgrade from packages without the hook; scriptlet errors are not claimed to abort that transaction.

Companion: Omarchy #9457. Current integration b787991 resolves the conflict against master b3c1ef8, preserves its 4.0.3rc1 source pin/checksum, and advances both release packages to 4.0.3rc1-3. Runtime requires the exact full version-release of its matching settings package in both channels. #239 is separate overlapping ownership work, not a required parent.

Still draft: the declared upstream source 7cc90574 predates #9457 and cannot build these settings recipes. After #9457 lands, advance both release pins and checksums together to the real upstream commit containing it, build the declared sources, and publish each matching pair together. The current pin must not be released. No fork revision or duplicate backport has been substituted for that upstream prerequisite.

Daybreak independently reviewed b787991 with source 60ac419f, verified all four x86_64 archive hashes, exclusive lifecycle ownership and exact pair dependencies, and found no new package-code blocker. Settings builds used normal dependency checks. Runtime builds used makepkg --nodeps; actual matched-pair installation in the disposable VM then checked their dependencies. Reinstall, stable/dev transfers, runtime/settings removal, aborting removal on a benign revocation error, and successful recovery all passed. The VM was restored afterward.

These builds used the explicit candidate OMARCHY_SRC override and do not validate the declared release pin. Four aarch64 payloads were also built on x86_64 and checked for architecture-specific contents/dependencies and exact lifecycle-file bytes; native ARM runtime and fresh-ISO validation remain untested.

[ErikMelton]

LGTM - pending 9457