Fix recurring first-run update prompts on Mac

[malik-na]

First-run setup retries at every graphical login when omarchy-settings omits omarchy-brightness-keyboard-auto.service, repeating the “Update System” notification even after an update.

Include the missing vendor service through the Mac package-build adaptation. Add migration 1789205735.sh to repair existing installs whose original migration completed with a dangling service link. Preserve custom wants entries and persistent/runtime masks, and keep actual service-operation failures retryable. New installs receive the service through the settings package and normal first-run enablement.

Regression coverage checks package contents, migration behavior, and first-run completion across repeated logins. The timezone notification argv correction is already in the base branch; distributing the matching desktop/settings package pair delivers both repairs.

Validation at bd1f2742b4dff9a14fe36d2d2243801b6622b158:

• Focused first-run, timezone, keyboard package/migration, and original keyboard tests pass. Command metadata and syntax checks pass.
• Unsigned aarch64 package archives built from the final source contain the exact service and migration bytes. A real pacman upgrade from the cached 4.0.2-2 pair to a validation 4.0.2-3 pair passed in a disposable root, preserving user data and migration markers. That transaction excluded dependencies, install scriptlets, and desktop hooks.
• The actual migration runner passed missing-payload retry, restored-payload offline completion, and repeat-run checks.
• ./test/all: CLI passes; 269 of 271 shell test files pass. Failures remain in network-qr-test.sh and settings-package-units-test.sh; this is not a clean full-suite result. ShellCheck was unavailable.

Native active-user-manager/ALS behavior, a live complete upgrade, physical fresh installation, and reboot remain unverified. These local package artifacts are validation builds, not a signed release.