## TLDR;

After updating Omarchy (I'm on he Edge branch) my user is removed from the docker group, meaning I now get errors accessing the docker socket. Looks related to #8056

Seems the user is removed but docker isnt 'made' sudo-less by default, leaving me in a weird state.

I would expect the update to force a restart if this is required, or otherwise for there to be a way for me to tell as a user that there are extra steps clearly

## Environment

- Omarchy: `4.0.0.r1849.g83881e9-1` (`omarchy-dev`)
- Docker: `1:29.7.2-1`
- User: `matt`

## Problem

After an Omarchy update/migration, standard Docker CLI commands no longer work without `sudo`:

```text
$ docker ps
permission denied while trying to connect to the docker API at unix:///var/run/docker.sock
```

The Docker daemon and socket are otherwise healthy:

```text
$ systemctl is-active docker.socket
active

$ stat -c %U\ %G\ %a\ %n /var/run/docker.sock
root docker 660 /var/run/docker.sock
```

However, the user is no longer a member of the `docker` group:

```text
$ id
uid=1000(matt) gid=1000(matt) groups=1000(matt),5(tty),984(uucp),992(input),998(wheel),1003(dialout)

$ getent group docker
docker:x:967:
```

## Investigation

This appears related to migration `migrations/1787580187.sh`, which invokes `omarchy-remove-security-sudoless-docker` and removes an existing user from the `docker` group.

I understand the security rationale: Docker group membership is effectively root-equivalent, and #8056 intentionally made this opt-in.

However, I cannot tell whether the corresponding opt-in/setup step was presented or completed on this installation. The resulting state is that a previously working `docker ps` workflow begins failing with a generic socket-permission error, without an obvious explanation or guided remediation.

## Expected behavior

When migration removes Docker-group membership, one of the following should happen:

1. Clearly notify the user that plain `docker` commands now require `sudo`; or
2. Prompt the user to explicitly choose sudoless Docker; or
3. Provide a visible post-migration message explaining how to enable it later.

For example:

```bash
omarchy setup security sudoless-docker
```

(or the equivalent supported command).

## Actual behavior

The group-removal portion appears to have executed, but I did not see an accompanying prompt or clear guidance. Standard Docker commands then fail:

```text
permission denied while trying to connect to the docker API at unix:///var/run/docker.sock
```

## Request

Could you confirm whether the migration is expected to present/setup the opt-in flow? If not, would you consider adding a notification or explicit migration prompt so users do not lose Docker CLI access without understanding why?