[feat] Discover and update integrations in existing VMs

[Fail-Safe]

Updating the Mac app preserves an existing VM but leaves users without a guided way to discover or install newly bundled guest features. This adds a launch-time integration check and an explicit setup/update flow that preserves the VM.

The app supplies a dedicated read-only bundle. Existing guests can install a small status service and review sudo Touch ID, clock recovery, package compatibility repairs, and optional 1Password integration. Installation requires guest authorization, retains backups and progress, and verifies completed components before skipping them on retry. Pairing and per-user 1Password activation remain explicit choices.

Dependencies and review scope

Draft, pending #182 (1Password), #184 (clock recovery), and #185 (existing-guest holds). Those prerequisite commits are included here so this branch can be built and tested. The unrelated graphics and launcher layout changes from the local integration build are excluded. The factory package-lock refresh is a separate prerequisite: #192.

Validation

• Full suite on the narrowed branch: 142 guest tests, 248 native tests, and shell/storage checks passed.

• Source-built runtime and factory image from an empty cache passed. Packaged app passed strict signing and macOS 15 compatibility checks.

• Fresh factory boot reported matching current base integrations before manual setup.

• At initial upstream submission, the integration payload matched the previously tested configured and historical VM upgrades byte-for-byte: cancel/install, reboot persistence, menu discovery, sudo Touch ID, 1Password Touch ID and password fallback, browser extension/passkey use, and short sleep/wake recovery. Authentication tests used the configured copy; the historical copy had no signed-in 1Password account. Subsequent wording and result-pause changes passed the full suite and app packaging checks; manual follow-up confirmed the updated Touch ID success/failure messages and the successful-installation acknowledgement prompt.

• Interrupted installer test retained a verified component, resumed remaining work, and completed with current status. Custom menu entries were preserved; the exact previous generated entry migrated to the banner-free action.

• Native AppKit probe confirmed Review is enabled normally, disabled while a modal dialog is open, and enabled again after dismissal. Direct menu clicking through the UI automation tool was unavailable because attachment timed out; the probe reproduces the same target/action setup.

• Touch ID results in the integration guide wait for Enter in an interactive terminal. Regression tests and pseudo-terminal checks cover success, failure, and cancellation while preserving failure status; noninteractive use does not gain a pause.

• Installation and optional 1Password setup retain their output until Enter in interactive terminals, including failure details. Terminal-session checks cover successful, failed, and interrupted child commands; declining installation and Exit do not pause.

Boundaries

No automatic Touch ID enrollment or 1Password sign-in; no existing-VM kernel or graphics upgrade. Status is advisory. Installation retains backups and resumable progress but does not promise transactional rollback of arbitrary PAM/systemd effects. Overnight sleep has not been established by the short sleep/wake test.

The factory lock refresh restores a build from currently available repository packages without the earlier local cache-only workaround. Merge prerequisites and rebase before marking this draft ready.

Visuals

Discover available integrations

The Mac app prompts existing VM users to review bundled integration updates.

Review setup instructions

Users can open the guide inside Omarchy or copy the setup command when the menu entry is missing.

Check integration status

A compact Mac menu-bar item shows integration status and provides access to the setup guide.

Find integrations inside Omarchy

A persistent entry under Setup makes integration updates and optional features easy to find again.

Guest setup and installation results

Choose an integration action

The guest guide shows installed support and offers integration updates, sudo Touch ID setup or testing, and optional 1Password setup.

Review installation results

Completion details and backup locations remain visible until the user presses Enter.