Harden updatedb configuration migration

[mdisec]

Fixes the privilege-escalation path in the updatedb migration by:

• Pinning the privileged configuration target to /etc/updatedb.conf.
• Removing the environment-controlled OMARCHY_UPDATEDB_CONF_PATH.
• Treating PRUNEPATHS strictly as data instead of interpolating it into a GNU sed program.
• Atomically replacing the configuration while preserving its ownership and permissions.
• Adding regression coverage for the reporter’s payload, poisoned paths, parser validity, metadata
  preservation, and idempotence.

Validation

• Focused locate tests: 14/14 passed.
• CLI suite passed.
• Confirmed on a stock Omarchy 4.0.2 VM through the real sudo/root path.
• The payload did not execute, the attacker-selected file remained unchanged, and /etc/updatedb.conf and the plocate service were unaffected.

Scope

This fixes Basecamp card 10266272792.