fix(cua-driver): leave pacman-managed updates to pacman

[f-trycua]

Scope

Fixes #3635.

Treat positive pacman ownership of the running executable as a reason to leave binary updates to pacman. This is a focused Linux update-path correction, not a new package-manager configuration interface.

• Do not advertise GitHub releases, cached versions, or nightly updates to package-managed installations.
• Return the existing unavailable-check result with pacman guidance, rather than claiming the package is up to date.
• Refuse the vendor installer and Driver channel changes; channel status also ignores stale saved preferences and reports pacman guidance. Never run sudo automatically.
• Query /usr/bin/pacman directly with a bounded ownership check; a PATH override cannot establish ownership.
• Preserve the unmanaged Linux, macOS, and Windows update paths.

The package workaround in omacom/omarchy-pkgs#306 must remain until a Driver release containing this fix is available through that package's normal release-age gate.

Validation and review status

• Focused tests pass on macOS: 4 updater unit tests, 31 version-check unit tests, 3 channel unit tests, and 2 existing CLI integration tests. The ownership-query unit fixtures run on this host; production detection remains Linux-only.
• Managed Linux process tests require a real pacman-owned binary, rather than a PATH fake. The new Arch CI job installs a unique fixture package, verifies CLI/MCP behavior through both direct and symlink paths, checks unmanaged behavior before/during/after installation, and verifies fixture removal. It records exact source, binary hashes, OS, and toolchain evidence.
• Targeted Rust formatting and whitespace checks pass. Regenerated the native MCP reference from the candidate binary and synchronized the shared tool description in Linux/Windows references. All 6 documentation-generator platform tests pass.
• Independent source review identified and corrected PATH-based ownership detection and stale channel status reporting. The existing JSON source field is retained for compatibility; documentation makes clear that no upstream check was performed.

Final head: 26207397584b77bbf26002a715f32748e9365d8d. The desktop matrices passed at product candidate 31d2e820cc58f4fc7cc8a11880bc88f5f087675a; subsequent changes only clarify the release availability in the docs and fix the new Arch job's Git ownership/source check. Product code, desktop tests, desktop runners, and desktop environments are unchanged. The Arch package test passed again on the final head.

• Native Arch pacman and Linux unit validation: passed at final head. Arch with pacman 7.1.0 ran all seven native test invocations with no skipped cases and verified fixture package removal. The retained evidence includes source SHA, candidate/test binary hashes, and toolchain versions. The earlier attempt failed before testing because of container checkout ownership; the corrected job verifies the expected SHA explicitly.
• Canonical Linux desktop matrix: passed. Shared apps: 48 delivered and 35 expected refusals; native: 32 delivered and 7 expected refusals; capture: 7 delivered. Zero failures or skips in these reports; installer lane also passed. Independent artifact audit verified declarations, exact source, and video evidence.
• Canonical Windows interactive desktop matrix: passed. Shared apps: 62 delivered and 22 expected refusals; native: 39 delivered and 4 expected refusals; capture: 9 delivered. Zero failures or skips in these reports; installer and matrix-summary lanes also passed. Artifact audit verified all 84 shared-app declarations, exact source, and per-cell video evidence.
• All applicable final PR checks passed, including Nix Rust tests and package/compositor builds, release metadata, contributor attribution, contract parity, documentation generation, links, and Linux/Windows unit compilation. The conditional installer-compatibility matrix was not applicable; its scope and summary checks passed.
• macOS update/channel coverage is focused CLI/unit testing; no macOS GUI behavior changed, and no macOS desktop certification is claimed.

The fix does not query pacman's repository databases or claim a package is up to date. The Arch fixture proves package-update behavior, not Hyprland input. No installed host Driver has been changed. Merge and publication of a component release are separate stages; published release 0.24.0 does not contain this fix.