[codex] Complete passwordless sudo expiry across suspend

[AFOliveira]

Depends on

This is an incremental follow-up to #9387. The branch is based on
security/nopasswd-expiry-fail-closed, preserving Erik Melton's commit and
Adolanium's co-authorship unchanged. Merge #9387 first, then rebase this branch
onto quattro before merging.

Problem

#9387 correctly makes timer-creation failure and reboot cleanup fail closed,
but its monotonic --on-active timer pauses during suspend. A 15-minute grant
can therefore remain usable after a much longer sleep.

The surrounding flow also needs one authoritative identity, state record, and
transaction boundary so timer races or a reusable sudo timestamp cannot
publish a grant without its promised expiry.

Finding: OM-SEC-01

Incremental remediation

• Arm the transient unit with the recorded absolute wall-clock epoch via
  --on-calendar=@EPOCH, so suspend time counts.
• Independently enforce EXPIRES during status checks and synchronously revoke
  an overdue grant before reporting it active.
• Bind root-owned state, the sudoers rule, and a randomized timer name to a
  validated numeric UID under one root lock.
• Verify the timer before publishing policy, then recheck it after publication;
  every partial or replacement failure revokes the grant.
• Start from a cold, command-scoped sudo credential and invalidate it on every
  exit path.
• Keep cleanup narrow and package-owned across boot, migration, and settings
  package removal.

Shared code and series structure

This PR introduces only the 87-line subset of omarchy-security-functions
used here. It centralizes privileged Bash startup checks, root-directory
validation, and fail-closed sudo cleanup. The remaining security PRs will be
rebased after this foundation lands and will source these methods instead of
carrying copies. They do not need to merge as one oversized PR.

The settings-package removal hook is a coordinated companion change and must
ship with this PR. omacom/omarchy-pkgs#257 is an 8-line follow-up to the
package-ownership work in omacom/omarchy-pkgs#239.

Validation

• test/shell.d/nopasswd-sudo-expiry-test.sh
• ./test/cli
• bash -n on every changed shell file
• git diff --check

./test/all reaches all 222 shell files; the only failure is the unchanged
test/shell.d/launch-about-test.sh UI fixture (a roomy window animates). The
same file fails identically on the untouched quattro baseline, and neither
it nor bin/omarchy-launch-about differs from #9387.

Regression coverage includes suspend-safe calendar arguments, overdue state,
timer races, failed replacement timers, malformed state, conservative boot
cleanup, package removal, concurrent calls, trusted caller identity, and sudo
credential cleanup.

[axelfontaine]

Regardless of the security aspects, there is way too much code duplication across this entire series! This should be reworked to extract the common methods to make it much easier to review.

[AFOliveira]

Regardless of the security aspects, there is way too much code duplication across this entire series! This should be reworked to extract the common methods to make it much easier to review.

I agree. The rate at which I'm catching these vulns is higher than my bandwidth, I need a better workflow to avoid becoming a slop-machine. I 'm reworking this PR

[AFOliveira]

Addressing Axel’s review before continuing the series:

• The dependent security PRs remain drafts; I am not pushing the 46-file integration refactor as a mega-PR.
• This branch now contains the minimal shared, source-only primitives used by this finding. Each surviving draft will be rebuilt to source the shared implementation and keep only its own production delta and regression.
• Commit 2f816a8 documents the narrow #!/bin/bash -p exception required to suppress BASH_ENV before the first command. The existing regression rejects ordinary Bash with a decoy -p argument.
• I withdrew [codex] OM-SEC-02: Keep Windows VM passwords out of process argv #9458, [codex] OM-SEC-06: Keep support data in private workspaces #9462, [codex] OM-SEC-11: Confine screen recorder state to a private runtime #9466, [codex] OM-SEC-13: Remove the package-conflict root-write primitive #9468, and [codex] OM-SEC-16: Validate source roots before privileged publication #9471 after local comparison showed that they were exact duplicates, worse than narrower existing fixes, or not an independent privilege boundary.

Local validation on 2f816a8 against exact base 945af75:

• git diff --check: pass
• changed-shell bash -n: pass
• nopasswd-sudo-expiry-test.sh: all 16 security cases pass
• CLI: all 116 cases pass
• full suite: 221/222 shell files pass; launch-about-test.sh fails the same a roomy window animates assertion on both candidate and exact base 945af75, so it is not a candidate regression

I will not mark any dependent draft ready until its copied helpers are removed and its final branch passes the same local gate.