Merge upstream quattro (plugin auth, Hermes updates, T3 theme, fullscreen)

[cursor]

Merges 42 new commits (30 non-merge) from omacom/omarchy quattro into this fork (since 3f91f06a / PR #9, 2026-09-06). Upstream HEAD is now e848f1df.

Fork-only Cursor work is preserved: official-tarball installer (omarchy-install-cursor-agent), usage collector, and no mise wrapper. Upstream's mise settings set upgrade.auto_prune false is taken; the Cursor mise install line is still omitted. Menu still labels the agent "Cursor CLI" at U+E90D.

Plugin authentication boundary (upstream omacom#9618 and follow-ups)

• Third-party shell plugins get scoped facades instead of the host object tree (bar, registry, first-party services, app library)
• Replacement bars cannot mint another plugin's service facade or see live host configuration
• Stale cached facade capabilities are revoked when a manifest changes
• Built-in clone integrations and clone summons stay available on replacement bars
• Authentication services refuse capability downgrades
• Lock and polkit plugins declare the new auth capability in their manifests

mise hardening (upstream omacom#7591 / omacom#7994)

• Upgrades no longer prune a version a running process is still executing from (upgrade.auto_prune false, plus migration 1787215483)
• omarchy-mise-install quotes package/command arguments and refuses unusable command names (slash, leading dash/dot, control characters)
• Cleanup still matches wrappers after those names are escaped

Hermes desktop (upstream omacom#10613)

• Prepares the native desktop app for in-app updates and a consistent first-update release
• Remove Hermes refuses while the app or its files are in use (live and deleted SQLite holders, packaged desktop, runtime cwd)
• The upstream Hermes .desktop launcher is hidden in Omarchy so only the packaged entry shows
• AI removers go through omarchy-cmd-present instead of raw command -v

T3 Code theme (upstream omacom#8784)

• Install > AI runs omarchy-install-ai-t3-code, which refreshes the current palette before first launch
• Theme switches publish t3code.json and select it in T3 Code via omarchy-theme-set-t3code

Kitty system defaults (upstream omacom#10605)

• Defaults move to /etc/xdg/kitty/kitty.conf; the user file stays for overrides
• Migration 1788745941 comments out unrestricted allow_remote_control on existing user configs and asks for a Kitty restart
• Manual explains how to opt out of Kitty theming

Sleep / GPU / sudo (upstream omacom#10425 / omacom#9387)

• Installed system-sleep hooks must be root-owned; migration 1788662350 repairs or quarantines writable copies
• GPU mode requests during sleep are bounded so a stuck transition cannot hang
• Passwordless sudo fails closed if the expiry timer cannot be armed; tmpfiles ships the expiry drop-in

Locate via packaged service (upstream omacom#10579)

• plocate-updatedb is configured through a systemd drop-in instead of rewriting /etc/updatedb.conf
• The old install/config/locate.sh path and migration 1784809451 are removed

Desktop polish

• Super + Ctrl + Alt + F toggles a full-screen desktop (hide the bar and window gaps together) — upstream Add Super + Ctrl + Alt + F to toggle a full screen desktop omacom/omarchy#10672
• Keyboard layout widget no longer switches a device nobody is typing on (upstream Stop the layout widget switching a device nobody types on omacom/omarchy#10670)
• 1Password starts at --force-device-scale-factor=1 so the hotkey matches the packaged desktop file (upstream Start 1Password at a fixed device scale factor omacom/omarchy#10673)

Conflict resolution

• install/user/mise.sh — took the auto-prune setting; still no Cursor mise wrapper (official tarball via omarchy-install-cursor-agent)
• migrations/1788577553.sh — unchanged no-op for the upstream Cursor mise wrapper
• default/omarchy/omarchy-menu.jsonc — T3 Code install action updated; Cursor CLI row untouched
• test/shell.d/hermes-remove-test.sh — put $ROOT/bin on PATH so the new omarchy-cmd-present gum check and in-use tests run outside a full Omarchy login PATH

Focused tests for default-agent (Cursor official install + Muse + OpenClaw), menu/font charset, mise-install, Hermes remove/desktop/CLI, plugin auth boundary, T3 Code install, fullscreen toggle, and 1Password launch passed. Ready to merge into quattro.