[codex] Revoke passwordless grants when settings is removed

[AFOliveira]

Depends on

This is an 8-line follow-up to #239 and should merge after it. It deliberately
reuses that maintainer-owned package-ownership work instead of copying it.

Companion source PR: omacom/omarchy#9457

Problem

The settings package owns the boot-time tmpfiles rule that removes stale
Omarchy passwordless-sudo grants. Removing the package removes that safety net;
without synchronous cleanup, an already-live sudoers rule could then survive
until an unrelated path removes it.

Fix

Both stable and development settings scriptlets remove only the namespace that
Omarchy's tmpfiles rule already owns:

/etc/sudoers.d/99-omarchy-nopasswd-*

This runs in post_remove, in the same package transaction that removes the
boot cleanup. Unrelated sudoers policy is untouched.

Validation

• Both install scriptlets pass bash -n.
• git diff --check passes.
• The companion regression test executes both real post_remove functions
  against disposable roots and confirms that generated grants are removed,
  unrelated policy remains, and Package Omarchy static system state #239's /etc/os-release ownership behavior is
  preserved.