Update Omarchy to 4.0.3

[themartiano]

Update the factory image from Omarchy 4.0.2 to the official 4.0.3 tag (0534987009061cbe2dacdde4ad564092ab698d12), deriving its commit, Git tree, normalized source digest, and timestamp with the existing pinning tool. Upstream still reports 4.0.0.alpha in its version file.

• Refresh the full ARM64 lock: 615 packages, with 28 version updates and the new numactl dependency. The upstream base package list is unchanged.
• Rebase the Vivaldi menu and notification privacy patches. Because 4.0.3 isolates authentication services, expose only a boolean lock state so notifications resume after unlock without publishing the credential-bearing service.
• Materialize and package the new Kitty system defaults and boot cleanup rule for temporary passwordless sudo grants.

Validation: official tag/source identity verification and the full source-aware guest contract pass, including all strict patch preimages/postimages and the notification lock-state regression. make test passes (including 261 Swift tests and the native networking/storage suites). GitHub CI passes. A QML runtime check in the staged guest also verifies that the actual lock-state binding follows service creation, lock/unlock, and teardown.

The full make guest build is still running from this commit. It has verified the pinned graphics libraries, materialized all backports, registered try-omarchy-runtime 4.0.3-1 (including the new system integration files), and verified the source-built ttfx binary. Hyprland compilation and final image validation have not yet completed.