[codex] OM-SEC-21: Authenticate only after package picker code exits

[AFOliveira]

Package selection runs with cold sudo authorization. After discovery and the configurable picker finish, only a validated selection reaches one fixed command-scoped Pacman transaction. Finding: OM-SEC-21.

Both install/remove entrypoints now resolve their canonical shared library, validate privileged Bash startup, sanitize inherited Bash state and bind the source root before invoking configurable picker behavior. They use #9457's byte-identical foundation and revoke on completion, cancellation and failure.

Query failures are checked before starting fzf, so cancellation cannot hide a broken package query. fzf success with no selection, exit1 (no match) and exit130 (cancel) are clean no-ops; partial output from a failed/cancelled picker is discarded. Only status0 plus allowlisted package names reaches the fixed Pacman argument array. #9795/#9227's AUR review/confirmation changes are separate scope; this picker uses repository packages.

At f5643b01, independent Daybreak final review accepts the corrections. The unprivileged orchestration fixture covers both commands' exact one-transaction success, no selection, native fzf status meanings, query/picker errors, authorization cancellation, failed transaction/revocation, source-root mismatch, inherited startup state and ordinary-Bash decoy-p rejection. CLI112, syntax and whitespace checks pass. No historical setuid/mutation model was run.

Depends on #9457's coordinated shared-helper release. Interactive real fzf/Pacman smoke in the installed package stack remains an integration check; these tests establish the control flow without changing host packages.

[AFOliveira]

Reworked in f1282ad after comparing the finding with current quattro and #9227. The PR is reduced from 10 files / 1,280 additions to a four-file, 421-addition diff, of which 276 lines are the isolated namespace regression and 87 are the shared #9457 library. All AUR/PKGBUILD, developer packaging, generic package-helper, wrapper, and unrelated-finding changes were removed. The original attack reproduces on the baseline, the fixed test passes, and its mutation restores the exploit. Full local validation details are now in the PR body. Keeping this draft until #9457 lands so the duplicate shared-library file can drop out cleanly.