Separate platform detection and pin Mac package builds

[malik-na]

Mac builds currently consume moving package recipes, and shared runtime paths can confuse architecture with Apple hardware or laptop capability. That can omit required payloads, choose x86 repositories after failed detection, break downloaded bootstrap scripts, or report a missing required package as successful. This change pins the source/recipe pair, separates those platform decisions and preserves early failures. It also guards unsupported resets and routes Apple lid-close events through the shared lock-aware handler.

Changes

• Integrate the existing architecture feature while retaining its Git ancestry and the package/reset/lid safeguards. The six x86 pacman channel/mirror templates match upstream quattro@988da12cb0748a79bffcefaeb3a48399b1d4dee0; ARM templates live under default/pacman/aarch64.
• Use one canonical architecture result, including the arm64 alias and failed-command status. Reject unsupported or failed architecture detection before architecture-dependent package/configuration mutations. Apple identity requires an actual apple, device-tree compatible entry. Laptop detection uses chassis/lid evidence instead of treating every Apple computer as a laptop; it has no board allowlist.
• Resolve build/install helpers from the checkout and preserve the relocated ARM installer's root path. Keep documented single-file upgrade, disk/bootstrap and publishing entrypoints self-contained so they work before new helpers are installed.
• Restore upstream's strict omarchy-pkg-add contract on ARM and x86. Keep explicit package-name substitutions in callers, check already installed local archives before AUR resolution, and preserve the optional Obsidian leaf's explicit repository-to-AUR fallback.
• Export package recipes from omacom/omarchy-pkgs@b81d678b3f18b66d3e99feeb72b762d06f3a56cd into a disposable directory and apply the reviewed Mac profile. Verify build dependencies by default, retain source integrity checks, record source/recipe/profile/archive provenance, and reject mismatched runtime/settings versions or releases.
• Preserve ARM Snapper/zram dependencies and the existing zram, oomd, app.slice, sysctl and zswap payloads. Deliver the ALS vendor service and the two Asahi-aware mkinitcpio drop-ins, remove stale ARM backup declarations, and seed the Bash-owned skel startup file through the Apple scriptlet. Evaluated upstream x86 recipe dependency/backup metadata remains unchanged.
• Refuse unsupported factory-reset backends before sudo or reset mutation. Correct the GRUB reset documentation. Both generic and Apple close events use the lock-aware handler; opening the lid retains display reconciliation.

Validation

Independent QA and review pass for final source 1988632d65c5fb8de8e3a64c485c6f6212cfa54f. All seven hosted checks pass: standard CI on the final branch and PR merge revision, plus ARM package-source validation and fresh/repeat installation.

• Hosted branch and PR checks pass Syntax + ShellCheck, test/all (all 262 shell test files) and tests/all. The PR jobs checked GitHub merge revision 3e506b3b4861b1f67e1992bdd012d305d9267265 against fork base b6298cde.
• ARM installation CI passes in 11m53s. Fresh and repeat installations use the pinned recipes, complete system/user setup and pass installed-userspace assertions. Both retain the explicit Hyprland stack versions and pass pacman database checks. The locally built font installs on the first run and is correctly recognized as installed afterward. This is isolated ARM userspace evidence, not a booted Apple hardware test.
• Independent implementation → QA → review, including reproduced and fixed bootstrap/helper-call regressions. Core focused tests cover no-DMI laptops/desktops, NUL-separated firmware values, actual lid capabilities, unsupported and failed detection, clean bootstrap PATH, zero mutation on rejected architecture, and required-package failures.
• Six x86 package templates and the shared package helper match the fetched upstream exactly. The previously reviewed package pin/profile/helper, reset guard and lid binding remain unchanged.
• All four native archives built and passed inspection at 845aea861afa03b61cd599e31eb672c910fa0b30: matching ARM metadata and runtime/settings versions, source-identical payloads/helpers, moved installer, both architecture configuration trees, valid backup paths and no cross-package file conflicts. Final 1988632d changes only a non-shipped Steam test; packaged inputs are unchanged, and archive provenance retains the actual build commit. No packages or build dependencies were installed on the physical Mac.
• Local core coverage: 21 focused files / 212 checks pass; full CLI passes 116 checks; raw shell result is 257/260 files. The ARM Steam fixture failure is fixed and independently passes on ARM and x86. The other two failures (network-QR sandbox networking and Plymouth source-alias rejection) reproduce on the previous PR head and pass focused diagnostics. Runtime corrections pass all four focused files. Metadata for 460 commands and syntax for 1,045 tracked shell files pass. The legacy suite passes 230 checks with one inherited installed-path help failure; root/graphical rehearsals are skipped. No completely green local aggregate is claimed.
• Approved read-only checks on the actual M1 Air pass for canonical ARM, ARM predicate, Apple identity and laptop detection. With DMI/ACPI hidden only from the process, the trace confirms that the actual firmware chassis-type=laptop supplies the result. These detector bytes are unchanged in the final correction commit.
• Retained M1 Air live evidence: early reset refusal without sudo or inspected filesystem/mount changes; ALS one-shot and temporary-service driver changes with brightness restored to 25/255 and the unit removed; undocked lid close invokes the lock, the user sees the lock screen, s2idle entry/exit completes, and display/keyboard/trackpad operate normally afterward. Original bindings and metadata were restored, transient units unloaded, and Hyprland reported no configuration errors.

Limits

The complete default-package loop still has its existing warning-and-continue behavior. Making that loop strict needs a decision about explicit ARM sources/substitutions; this change does not silently classify missing packages as optional. Strictness here is the shared required-package helper's contract. Both new ARM logs still report five other default requests as skipped: asdcontrol, hyprland-preview-share-picker, omarchy-nvim, qemu-user-static-binfmt and tobi-try. That message does not establish that no ARM source exists; source/substitution decisions remain deferred. The experimental non-Apple ARM path remains for isolated userspace installation CI, without a generic ARM hardware support claim.

Only a MacBook Air M1 (2020, j313) is physically available. Other supported M1/M2 models, docked lid handling, a full candidate pacman installation on Apple hardware and booting that installed candidate remain unverified. ALS driver/service checks passed, but the user noticed no visible backlight change. The lid cycle logged brcmfmac warnings of unestablished cause; post-resume connectivity was normal. DCP IOAV/PMU messages also occur before the test.

The reset guard validates required tools and conventional boot files; it neither discovers the active bootloader nor establishes successful reset support. The source version remains 4.0.0.alpha while the pinned recipes produce runtime/settings 4.0.2-1; provenance records both, and release publication requires an intentional version decision.

Architecture/bootstrap contracts are documented in docs/platform-detection.md; recipe update procedure and profile ownership are in docs/package-builds.md. This remains a draft in the Mac fork, with no upstream PR.

[malik-na]

Please rebase this integration branch onto current quattro and resolve the conflicts before further review. #331 is already contained here, so keep one merge sequence and retire the redundant path once this is updated.