### System details

Omarchy dev branch at 3eca9573; first-run sudoers; hardware independent

### What's wrong?

Omarchy creates `/etc/sudoers.d/first-run` during install so first-run scripts can finish setup after the user logs in. That sudoers file currently grants the installing user passwordless access to `/usr/bin/systemctl` with no argument restrictions:

```bash
$USER ALL=(ALL) NOPASSWD: /usr/bin/systemctl
```

First-run only needs one root `systemctl` call:

```bash
sudo systemctl enable ufw
```

Because sudoers treats a command with no argument list as allowing any arguments, any process running as the user before first-run cleanup can invoke arbitrary root `systemctl` actions without a password. That widens a temporary first-run convenience rule into a general root service-control path.

Steps to recreate:

1. Run the Omarchy install path through `install/preflight/first-run-mode.sh`.
2. Inspect `/etc/sudoers.d/first-run` or run `sudo -l` for the installing user.
3. Notice the unrestricted `NOPASSWD: /usr/bin/systemctl` entry.
4. Compare it to the only root systemctl call in first-run: `sudo systemctl enable ufw` in `install/first-run/firewall.sh`.

Expected behavior:

The temporary first-run sudoers file should permit only the exact root commands first-run needs, such as `systemctl enable ufw`, and should keep cleanup commands explicit.

Actual behavior:

The temporary sudoers file permits passwordless root `systemctl` with arbitrary arguments until first-run removes `/etc/sudoers.d/first-run`.

Suggested fix:

Replace the bare `systemctl` sudoers entry with a `Cmnd_Alias` for `/usr/bin/systemctl enable ufw`, and update reboot sudoers cleanup so it uses an explicitly permitted cleanup command rather than an unpermitted `sudo test` precheck.