Harden Apple Silicon first login and snapshot setup

[scottjones]

Summary

This is the accumulated desktop companion branch used by the fresh M3 installer test.

• Provide software-GL Electron wrappers when Apple Silicon has no render GPU, including 1Password setup, and avoid privileged chmod when an existing wrapper already has the correct permissions.
• Refuse boot-to-ESP migration for ISO/shared/UUID-private boot layouts instead of moving files into an incompatible layout.
• Correct first-run timezone notification argument handling and add coverage.
• Detect non-btrfs roots explicitly during Snapper setup. On btrfs, retain real setup diagnostics and exit status instead of hiding missing/broken Snapper as an unsupported filesystem.
• Add focused Snapper setup regressions and actual package-staging coverage for every first-run user service.

Verification

• Focused Snapper tests pass; all eight stable/development × ARM/x86 × current-source/actual-stable-pin package-staging cases pass with the companion package changes.
• Earlier focused wrapper, boot-layout, and timezone tests passed. Command metadata validation (461 commands), shebang-aware syntax checks, and whitespace checks passed in isolated QA.
• Full aggregate QA is not entirely green: three environment-dependent failures remained (inherited NO_COLOR, sandbox network access, and inherited Git signing). Baseline checks or isolated reruns identified these limitations; this PR does not claim a clean aggregate run.
• SWE → QA → review completed, including a second round testing the actual stable source pin.
• A full ISO/rootfs rebuild with these sources completed a fresh encrypted M3 (j613) install. First-run completed, Snapper and the factory snapshot were present, and required services were enabled with no failed units. Tester subsequently confirmed reboot, acceptable UI responsiveness, 1Password installation, and no repeated first-boot alerts.

Dependencies and review scope

• Package recipes and this new package-staging test must land together: Fix ARM Snapper dependency and first-run keyboard service packaging omarchy-pkgs#341. The test intentionally fails against the unfixed upstream recipes. CI using the package repository's default branch needs that PR merged (or an explicit companion checkout).
• Installer companion: Harden Apple Silicon provisioning and shared-ESP reinstalls omarchy-mac/omarchy-mac-iso#19.
• This branch already contains the source changes from Wrap Electron with software GL when Apple Silicon has no render GPU #349 and Fix first-run timezone toast on Apple Silicon #362, plus the wrapper-permission and timezone regression follow-ups; those portions overlap the existing PRs.
• Fix first-run login loop caused by unpackaged user units #367 is a separate first-run repair/build-wrapper approach. This branch tests the real package recipes and preserves fatal setup errors; it does not include that PR's migration or alter it.

Hardware validation covers one M3 with 7.2.2-omarchy-wip72+, not all Apple Silicon models.

[malik-na]

The source changes are coherent, but test/all is red because the settings-unit test needs the companion recipes. Pin or merge omarchy-pkgs#341 in CI as #377 does, rerun, and clarify whether #372 or #377 is the merge path.