### What happened

The `[omarchy]` repo's `1password 8.12.36-2` ships a polkit policy with the
**build host's** username baked in, instead of the installing user's.

`/usr/share/polkit-1/actions/com.1password.1Password.policy` as installed:

```xml
<action id="com.1password.1Password.authorizeCLI">
  ...
  <annotate key="org.freedesktop.policykit.owner">unix-user:builder </annotate>
</action>
<action id="com.1password.1Password.authorizeSshAgent">
  ...
  <annotate key="org.freedesktop.policykit.owner">unix-user:builder </annotate>
</action>
```

`builder` is the account on the repo's build machine. It does not exist on the
installed system, so both actions are owned by a non-existent principal on
every machine that installs this package.

### Root cause

This generation step is meant to run **on the target machine**. 1Password's own
bundled installer, shipped inside the package at `/opt/1Password/after-install.sh`,
does it at lines 109–117:

```bash
# Fill in policy kit file with a list of (the first 10) human users of the system.
export POLICY_OWNERS
POLICY_OWNERS="$(cut -d: -f1,3 /etc/passwd | grep -E ':[0-9]{4}$' | cut -d: -f1 | head -n 10 | sed 's/^/unix-user:/' | tr '\n' ' ')"
...
install -Dm0644 ./com.1password.1Password.policy -t /usr/share/polkit-1/actions/
```

The packaging instead runs that expansion at **build** time (inherited from the
AUR PKGBUILD's `package()`), which is sound when each user builds locally but
wrong for a prebuilt binary repo — it captures the builder's `/etc/passwd`.

The package's install hook (`/var/lib/pacman/local/1password-8.12.36-2/install`)
creates the `onepassword` group and sets up `1Password-BrowserSupport`, but
never invokes `after-install.sh`.

### This is the same root cause as #11830

#11830 reports the MCP group/setgid setup missing from this same package
version. That setup is **also** in `after-install.sh`, at lines 147–148:

```
# Setup the MCP server binary with its own group and setgid so OPH can verify
# connecting peers via SO_PEERCRED.
```

Both bugs are the one omission — the vendor's install-time script is shipped
but never run. I confirmed #11830 reproduces on this machine as well
(`getent group onepassword-mcp` returns nothing).

### `after-install.sh` cannot currently be used as a local repair

The packaging deletes `com.1password.1Password.policy.tpl`, which
`after-install.sh` reads at line 113. So running the vendor script by hand
fails at the polkit step. Any fix needs to retain the template in the package.

### Expected

The polkit `owner` annotation should name users on the installing system.

### Impact

Limited to the two annotated actions:

- `com.1password.1Password.authorizeCLI` — 1Password CLI (`op`) authorizing against the desktop app
- `com.1password.1Password.authorizeSshAgent` — the 1Password SSH agent

`com.1password.1Password.unlock` has no owner annotation, so desktop and
fingerprint unlock are unaffected. GUI-only users will not notice, which likely
explains why this went unreported while #11830's louder MCP failure did not.

### Steps to reproduce

1. `omarchy pkg add 1password` (resolves from `[omarchy]`, not the AUR)
2. `grep owner /usr/share/polkit-1/actions/com.1password.1Password.policy`
3. Observe `unix-user:builder` rather than the local user

### Suggested fix

Run the vendor's `after-install.sh` (or port its logic) from
`post_install`/`post_upgrade`, and stop deleting
`com.1password.1Password.policy.tpl` so the polkit step can execute. That
addresses this report and #11830 together, and keeps future install-time steps
from drifting out of the package.

### Notes

- `[omarchy]` ships `8.12.36-2`; the AUR is at `8.12.36-42`. Same upstream app
  version, 40 packaging revisions apart — possibly worth checking separately
  whether the repo build tracks AUR packaging fixes.
- Signature and checksum validate correctly (`Validated By: SHA-256 Sum  Signature`).
  This is a packaging-correctness bug, not an integrity or security one.

### System

| | |
|---|---|
| Omarchy | 4.0.4-1 (stable channel) |
| Kernel | 7.2.5-3-omarchy |
| CPU | AMD Ryzen 5 PRO 4650U with Radeon Graphics |
| GPU | AMD Renoir (Radeon Vega Mobile Series) |
| Package | `1password 8.12.36-2`, repo `[omarchy]`, built 2026-09-12 |

`omarchy debug --no-sudo --print` is not a valid command on this installation
(`Unknown Omarchy command`), so no generated debug bundle is attached — same as
noted in #11830.