[codex] Package the native debug launcher with settings

[AFOliveira]

Packages the native debug authorization boundary from omarchy#9477. Previously this companion only moved a shared library and would still install the unsupported Bash payload as the public command.

This branch now builds on #257's settings ownership and exact runtime/settings version pairing. Settings compiles and checks a static PIE launcher, installs it root-owned 0755 at /usr/bin/omarchy-debug, installs the Bash collector at the fixed /usr/lib/omarchy/omarchy-debug-collector path, and ships its CLI metadata sidecar. Runtime packages exclude these settings-owned commands and preserve the shared helper's sole owner. The stable pair advances together to pkgrel3.

At packaging a1de198 with exact source f57934c1, all four package variants built. Archive inspection and independent Daybreak review confirmed ELF static PIE/no interpreter or needed shared libraries, non-executable stack, RELRO/NOW, collector/metadata hashes, ownership and exact pair dependencies. The matched x86_64 4.0.2-3 archives installed successfully in the disposable VM: help/JSON routing passed, --no-sudo used zero prompts, normal dmesg collection used one, both produced private logs, and sudo authorization was revoked afterward.

Release gate: the stable _commit=346e69e1 lacks the new launcher, metadata and #257 companion support. Advance all coordinated source pins/checksums after the upstream source lands and rebuild without OMARCHY_SRC; do not release this recipe against the old pin. These successful builds deliberately used the candidate override with dependency checking skipped. Fresh ISO and aarch64 are still unvalidated. Remains draft.