## What happened

`omarchy update` fails every time at migration `1787515927` ("Stop world-writable Chromium and Firefox policy directories"), and it fails identically on every retry because the migration's completion marker is never written.

The migration is not itself broken. It aborts because `omarchy-theme-set-browser-policy` returns exit status 1 even when it has done its work correctly, and `omarchy-theme-set-browser` propagates that as its own exit status into a migration running under `bash -euo pipefail`.

The nonzero status comes from the `EXIT` trap in `bin/omarchy-theme-set-browser-policy`:

```bash
failed=0
staged=""
cleanup() {
  [[ -n $staged ]] && rm -f "$staged"
}
trap cleanup EXIT
```

`staged` is deliberately cleared after each policy file is written, so on every successful run it is empty when the script exits. `[[ -n $staged ]]` is then false, the `&&` list short-circuits, and `cleanup` returns 1. Under Bash 5.3 the status of the `EXIT` trap's last command becomes the script's exit status, so `exit "$failed"` (with `failed=0`) is overridden by the trap. Bash 5.2 did not do this.

Minimal reproduction of the Bash behavior, isolated from Omarchy:

```console
$ bash -c 'set -euo pipefail; staged=""; cleanup(){ [[ -n $staged ]] && rm -f "$staged"; }; trap cleanup EXIT; exit 0'; echo $?
1
$ bash -c 'set -euo pipefail; cleanup(){ true; }; trap cleanup EXIT; exit 0'; echo $?
0
```

And on the real script, which writes the correct file and still reports failure:

```console
$ sudo -n /usr/bin/omarchy-theme-set-browser-policy 060b1e; echo "exit=$?"
exit=1
$ cat /etc/chromium/policies/managed/color.json
{"BrowserThemeColor": "#060b1e", "BrowserColorScheme": "device"}
```

## Steps to reproduce

On a system with Bash 5.3 (Arch `bash 5.3.15-1`) and at least one Chromium-family policy directory present (`/etc/chromium/policies/managed`):

1. Run `omarchy update` with migration `1787515927` still pending.
2. The update prints `Running migration (1787515927)` / `Stop world-writable Chromium and Firefox policy directories`, then the generic "Something went wrong during the update!" trap fires. `/tmp/omarchy-update.log` shows no error between the migration banner and the failure.
3. Retrying `omarchy update` fails at exactly the same point, because `omarchy-migrate` only touches the state marker after the migration script succeeds.

Direct reproduction without running an update: `omarchy-theme-set-browser-policy <rrggbb>; echo $?` returns 1 while writing the policy file correctly.

## What was expected

`omarchy-theme-set-browser-policy` should exit 0 when it successfully writes every applicable policy file, so the migration completes, the marker is written, and the update proceeds.

## Consequences beyond the update

- The Firefox half of migration `1787515927` never runs. On this machine `/opt/zen-browser/distribution` is still mode `777` — precisely the world-writable directory the migration exists to harden. Any system where the Chromium loop runs first will silently skip the Firefox hardening.
- `omarchy-theme-set` calls `omarchy-theme-set-browser` (bin/omarchy-theme-set:329), so every theme change also gets a spurious nonzero status from the browser step.

## Suggested fix

Make `cleanup` not end on a false test, so the trap's status cannot leak:

```bash
cleanup() {
  if [[ -n $staged ]]; then
    rm -f "$staged"
  fi
}
```

I checked the other 27 scripts in `bin/` that install an `EXIT` trap; this is the only one whose trap handler can end on a failing command, so the fix appears to be contained to this file.

## System details

- Omarchy: `4.0.0.r1872.g7d58bb9-1`
- Bash: `5.3.15-1`
- Kernel: `7.1.8-arch1-3`
- CPU: AMD Ryzen AI MAX 390 w/ Radeon 8050S
- GPU: AMD Strix Halo (Radeon 8050S/8060S Graphics)

Verified that `bin/omarchy-theme-set-browser-policy` on the `quattro` branch is byte-identical to the installed copy, so this is not a packaging artifact.

## Possibly related

#8212 and #8158 also report `omarchy-theme-set-browser` breaking the update, but through a hang on `brave-origin` rather than an exit status; this one reproduces with no Brave installed.