[fix] Repair update holds in existing guests

[Fail-Safe]

Older guests can still fail Omarchy Update with conflicting libaquamarine.so dependencies after updating the Mac app. The current factory hold list does not migrate into existing disks, and editing only /etc/pacman.conf is temporary: the pre-refresh hook restores /usr/share/try-omarchy/pacman.conf over it.

Add an explicit, standalone guest/scripts/repair-update-holds.py maintenance command for existing ARM guests. It previews by default and requires root plus --apply to add missing kernel, kernel-header, Hyprland, aquamarine, and Hyprtoolkit holds to both configurations. It preserves each file's existing settings and comments, backs up both originals, cooperates with the pacman transaction lock, and restores the first file if writing the second fails. Repeat runs make no changes once both files are correct.

The README explains how to copy and run the command inside an existing guest, restore backups, and keep custom settings in the saved configuration that the update hook uses. This does not change factory package pins, install packages, or recover an already incompatible installed package set. Existing guests must explicitly run the repair; merely updating the Mac app still does not migrate them.

Validation:

• make test passed, including 114 guest tests, 242 native tests, and shell/storage contracts. The existing virtio-pinch guest ABI test was skipped because QEMU_PINCH_TEST_BINARY was not set.

• Eleven repair tests cover custom settings, multiple hold directives, missing directives, line endings, factory hold parity, preview behavior, backups/modes, restore-and-repeat behavior, malformed files, symlinks, transaction locks, and rollback.

• On an existing ARM guest, resolution against its stale saved template exited 1 with the Hyprtoolkit libaquamarine.so=14-64 dependency conflict. A temporary copy produced by this command parsed successfully with pacman-conf, and pacman -Sup against it exited 0 using the same synchronized package databases. No packages were installed or upgraded for this check.

• End-to-end existing-guest validation: the user applied the repair successfully. The next update encountered the separate 10 GiB free-space requirement; after enlarging the VM disk using the existing resize tool, the user confirmed that Omarchy Update completed successfully.

Fixes #147.