## What happens

The menu entry **Toggle passwordless sudo** (and `omarchy sudo passwordless`) always ends with:

```
Toggle passwordless sudo...
[sudo] password for <user>:
⚠️ WARNING: ... 15 minutes ...
[sudo] password for <user>:
● Failed (exit code 1)!
```

Two prompts are accepted (so `__status` works and correctly reports `3`/inactive), `__enable` then exits 1 and **publishes nothing**. Before #13454 the failure was completely silent; with #13454 the interface names the missing file, but the grant still cannot be published.

## Cause

`bin/omarchy-sudo-passwordless` refuses to publish a grant unless its revocation hook is installed:

```
readonly PACKAGE_HOOK=/usr/share/libalpm/hooks/05-omarchy-passwordless-revoke.hook   # line 29
verify_boot_cleanup() { ...
  verify_root_path "$PACKAGE_HOOK" || return 1                                       # line 214
```

That hook is **not shipped by the installed package**, and nothing else installs it either:

```
$ pacman -Q omarchy-dev
omarchy-dev 4.0.0.r6688.ge332dc9-1
$ pacman -Ql omarchy-dev | grep libalpm
omarchy-dev /usr/share/libalpm/
omarchy-dev /usr/share/libalpm/hooks/
omarchy-dev /usr/share/libalpm/hooks/00-omarchy-update-guard.hook
omarchy-dev /usr/share/libalpm/hooks/10-omarchy-hyprland-reload-pause.hook
omarchy-dev /usr/share/libalpm/hooks/90-omarchy-hyprland-reload-resume.hook
$ pacman -Qkk omarchy-dev
omarchy-dev: 1867 total files, 0 altered files        # the package is complete *as built*
$ pacman -Qo /usr/share/libalpm/hooks/05-omarchy-passwordless-revoke.hook
error: No package owns /usr/share/libalpm/hooks/05-omarchy-passwordless-revoke.hook
```

`default/libalpm/hooks/05-omarchy-passwordless-revoke.hook` exists in the source tree (added by a6385e60, an ancestor of current `quattro`), and `docs/file-layout.md` states the mapping:

```
default/libalpm/hooks/*.hook  ──►  omarchy  /usr/share/libalpm/hooks/*.hook
```

Nothing in `bin/`, `install/`, or `migrations/` copies it into place either (`grep -rn 'libalpm/hooks\|PACKAGE_HOOK' bin/ migrations/ install/` only matches the script's own constant), so `verify_boot_cleanup` returns 1 on a normal install and **no passwordless grant can ever be published**. The file is present only as `/usr/share/omarchy/default/libalpm/hooks/05-...` (shipped by `omarchy-settings-dev`), which is a source copy, not the path the check requires.

## Workaround

```
sudo install -o root -g root -m 0644 \
  /usr/share/omarchy/default/libalpm/hooks/05-omarchy-passwordless-revoke.hook \
  /usr/share/libalpm/hooks/05-omarchy-passwordless-revoke.hook
```

With that file in place, all three `verify_boot_cleanup` preconditions pass (removal blocker absent, boot cleanup rule valid, hook present) and `__enable` proceeds.

## Environment

- `omarchy-dev`/`omarchy-settings-dev` `4.0.0.r6688.ge332dc9-1`, `quattro` dev channel, dev-linked checkout at `~/omarchy` (checkout and installed copies of the script are byte-identical).
- Locale `es_MX.UTF-8` (unrelated to this bug, but note the CJK/`stat %F` locale reports elsewhere).