[feat] Discover and update integrations in existing VMs

[Fail-Safe]

Upstream follow-up: omacom/try-omarchy#193 contains the narrowed version based on current upstream main, with #192 providing the separate factory-lock refresh. This fork draft retains the original local integration baseline for reference.

Updating the Mac app preserves an existing VM, but previously gave its users no guided way to discover or install newly bundled guest integrations. This adds a launch-time status check and an explicit setup/update flow for existing guests without resetting their disks.

The app exposes its integration bundle through a dedicated read-only share. A guest service reports component health over a bounded, advisory virtio channel. The launcher retains the last check and offers setup when updates or repairs may be needed. Installation requires guest authorization, retains backups and progress, preserves custom menu entries, and skips already-verified components on retry. Touch ID enrollment and per-user 1Password activation remain explicit choices.

The initial scope covers sudo Touch ID support, clock recovery, compatibility-hold repair, and optional 1Password integration. It does not upgrade the kernel or graphics stack.

Review scope

This is a draft review in the fork against codex/integration-updates-base, so the diff contains only this feature. The baseline incorporates the existing integration and launcher work, including upstream PRs omacom#182, omacom#184, omacom#185, and omacom#187. Resolve those dependencies before preparing a standalone upstream PR. This is not a request to merge the integration baseline into upstream main.

Validation

• Full test suite passed: 156 guest tests, 249 native tests, and shell/storage checks.
• Native app build, compatibility checks, and strict signature verification passed.
• Disposable guest with bootstrap disabled and compatibility holds removed: missing-agent detection, read-only bundle mount, installation, custom menu preservation, repeated installation, and current host status after restart verified.
• The guest command remounts the bundle after reboot and retains already-verified components.
• Setup instructions are compact and selectable; status polling continues while native modal dialogs are open.

Existing-VM authentication validation

Manual testing on an isolated copy of an existing configured VM passed:

• Bootstrap installation from the app-supplied command and matching current status received by the host.
• Optional 1Password setup through the integration guide, followed by successful Touch ID unlock.
• Cancellation of Touch ID followed by successful Linux-user-password fallback.
• sudo Touch ID authentication through the guide.
• Firefox extension Touch ID unlock and a successful website passkey sign-in.
• Short Mac sleep/wake: guest clock recovery, 1Password Touch ID, and sudo authentication all passed. Overnight sleep has not been established by this short test.

A separate local build-support change accepts cached .xz archives alongside .zst and selects four existing locked package versions from signed cache. With that change, the fresh factory-image build completed and filesystem verification passed; the resulting app passed signing and compatibility checks. The package lock was not changed. This build-support dependency still needs separate review and does not establish an empty-cache build.

Additional runtime validation

• Follow-up installer fixes passed on the configured VM: no display-authorization warnings, and the Setup menu entry appeared immediately, opened the guide, and exited normally.

• Reboot persistence passed on both the configured VM and an isolated historical backup. Fresh host reports matched the app bundle and showed all five components current after the final historical restart.

• Historical onboarding passed: missing bootstrap detection, replacement preview, cancellation, subsequent installation, clock timer enablement, repair of both package-hold configurations, and reporter enablement.

• Optional 1Password integration installation passed on the historical copy. That copy had no signed-in account, so authentication was not tested there; authentication results above apply to the configured copy.

• The rebuilt factory image booted and reported base integration health before manual setup. Its bundled payload predates the latest installer fixes, so a newer-app update notice was expected. Final factory/app payload alignment still needs validation.

• The native menu-bar status now uses a compact icon, with details in its menu and tooltip; full tests and app packaging passed.

• Runtime interruption/retry passed in a disposable guest: the installer was terminated between sudo and clock installation, retained the verified sudo receipt and incomplete clock progress, then resumed with the unmodified production updater and reported all base components current.

• 1Password wording now distinguishes installed integration support from account setup and a verified unlock.

• The guide opens without the presentation banner. Its floating terminal was visually checked in a disposable desktop session. An exact previous generated menu entry migrates to the new action, while custom entries remain unchanged; both automated and real-guest migration checks passed.

• The final app passed strict signature and macOS compatibility verification. Direct inspection of the final factory filesystem confirmed its integration inventory exactly matches the final source bundle.

• Final aligned factory boot passed: the host received matching current bootstrap, sudo, clock, and compatibility-hold status before manual setup; no integration-update notice marker was created. The test VM was then shut down gracefully.

Remaining release gates

• The narrowed upstream draft awaits prerequisites [feat] Add Touch ID unlock for guest 1Password omacom/try-omarchy#182, [fix] Recover guest clock after Mac sleep omacom/try-omarchy#184, [fix] Repair update holds in existing guests omacom/try-omarchy#185, and [fix] Refresh the factory lock for available ARM packages omacom/try-omarchy#192, followed by a rebase before readiness.
• The earlier cached-archive workaround is superseded on the upstream branch by [fix] Refresh the factory lock for available ARM packages omacom/try-omarchy#192. That branch passed a factory build from a brand-new empty cache, a source-built native runtime, app packaging and signing, and a fresh boot reporting the matching integration inventory. These later results apply to the upstream branch; this historical fork branch retains its original baseline.

Installation is resumable with retained backups; it does not claim transactional rollback of arbitrary PAM or systemd effects.