Fix password prompts for theme and DNS menu actions

[themartiano]

Summary

Switching themes or selecting a stock DNS provider currently falls back to a polkit password dialog because the factory image omits upstream's scoped sudoers grants. Install omarchy-dns and omarchy-theme-browser unchanged from the pinned Omarchy 4.0.3 source, with mode 0440, and include them in try-omarchy-runtime.

The grants cover only Cloudflare/Google/DHCP and the browser policy helper with a six-digit lowercase hex color. Custom DNS and unrelated sudo operations retain their existing authentication. Factory finalization checks sudoers syntax, root ownership, permissions, and package ownership.

This applies to new/reset VMs. Replacing the Mac app does not modify an existing guest; the guest documentation makes that limitation explicit.

Closes #214.

Validation

• make test passed.
• guest/test --source /private/tmp/try-omarchy-214-source passed against the pinned commit and release tag, including exact policy bytes and mode checks.
• Both upstream drop-ins pass visudo -cf.
• Upstream commit/tree/source digest and package pins are unchanged; both policy files and their helper argument validation were reviewed.
• bash macos/Tests/run-qemu-ssh-contract.test.sh passed after rebasing onto current main.
• make guest built the pinned ABI packages, then stopped before rootfs staging because the live package transaction differs from the committed lock: libadwaita 1:1.9.3-1 → 1:1.9.4-1, libde265 1.1.2-1 → 1.1.3-1, libtirpc 1.3.7-1 → 1.3.8-1, linux-aarch64 and headers 7.2.5-1 → 7.2.6-1, qt6-declarative 6.11.2-1 → 6.11.2-2, and tzdata 2026c-1 → 2026d-1. No package pins were changed for this fix. Full image/package-ownership validation and a live guest menu smoke test remain unverified.