Discover and update sudo integrations in existing VMs

[Fail-Safe]

Updating the Mac app preserves an existing VM but does not install newly bundled guest integration support. This adds launch-time discovery and a user-approved installation and repair flow, initially delivering the sudo Touch ID integration already present on main.

Scope

• Rebased onto v0.4.0 (7c7acee); no dependency on [feat] Add Touch ID unlock for guest 1Password #182, [fix] Recover guest clock after Mac sleep #184, [fix] Repair update holds in existing guests #185, or [fix] Refresh the factory lock for available ARM packages #192.
• A dedicated read-only bundle, bounded guest status channel, per-disk status cache, Review controls, and an Omarchy Setup entry.
• Guest-authorized installation with verified payloads, retained backups, resumable component receipts, and verification before a completed step is skipped.
• Optional sudo Touch ID pairing remains explicit. Interactive results stay visible until acknowledged.
• Guests with broader development bundles are identified and protected from replacement by this smaller bundle.
• No package-lock changes, package upgrades, clock recovery, compatibility-hold repair, or 1Password delivery in this PR.

Validation of this revision

• Full make test passed, including guest tests, 274 native tests, and launcher/network/storage shell checks. The final native regression rerun also passed all 274 tests.
• Built the app against the published v0.4.0 guest and runtime payloads. Strict code-signing checks and macOS 15 compatibility checks passed for all 21 Mach-O images.
• Booted a separate cloned existing VM through the rebuilt launcher. Cancellation left the installer state and menu unchanged; installation enabled reporting and produced a matching current bundle status in the native cache.
• Simulated interrupted progress after a verified component; retry retained the verified sudo component and completed. A modified installed file reported repair and was reinstalled and reverified. The final guard also allowed repair of a damaged installed bundle with a matching inventory, while retaining protection for additional integrations.
• Reboot retained active reporting and current component status. Custom menu content survived; package configuration and sudo PAM content matched the original fixture before and after reboot.
• Tests cover corrupted/unlisted files, symlinks, menu preservation, incomplete status, interactive acknowledgement, and refusing a smaller bundle over additional installed support.

Remaining release qualification

A source factory-guest build was attempted using the unchanged upstream lock. It stopped because seven currently available repository packages differ from that lock. This refresh deliberately leaves lock maintenance separate. A fully rebuilt factory image and first-boot bootstrap check remain a release qualification step after the upstream lock is refreshed.

The runtime check used an existing disposable guest with an unpaired test account; it did not repeat physical Touch ID authorization or graphical shell menu interaction. The historical screenshots below illustrate the earlier development flow. No claim of byte-identical validation from that broader draft is carried forward.

Status remains advisory. No automatic pairing, guest kernel/graphics upgrade, or transactional rollback guarantee for arbitrary PAM/systemd effects.

Historical visual walkthrough

These six retained screenshots are from the earlier broader draft. Wording and component lists have since been narrowed to sudo Touch ID; clock, compatibility repair, and 1Password options shown in historical images are outside this revision.

Discover available integrations

Review setup instructions

Check integration status

Find integrations inside Omarchy

Guest setup and installation results

Choose an integration action (historical component list)

Review installation results (historical component list)