feat(arch): establish reproducibility plans and fix Quattro Qt compatibility

[jdfesa]

Summary

Close out the existing Arch reproducibility checkpoint together with the verified Quattro menu recovery. This branch contains three commits and remains scoped to Arch runtime changes, shared profile safety checks, and planning/evidence updates.

What this branch contains

Arch reproducibility planning

• Add complete OpenSpec proposals, designs, specifications, and task lists for an Arch workstation desired-state contract, read-only planning, hardware/manual gates, layered verification, and recovery evidence.
• Add a separate core-only tmux adoption plan with canary/SSH/terminal validation and explicit rollback boundaries.
• Update OpenSpec project context and refresh deterministic Chezmoi pilot evidence and generated comparison documents.
• These two OpenSpec changes are plans, not completed implementations. This PR does not deploy a new provisioner, activate tmux, adopt Chezmoi, or perform disk/boot operations.

Existing safety fixes

• Reject ambiguous/traversing profile targets below $HOME, with regression coverage.
• Require synchronized pacman -Syu --needed upgrades before installing Quattro dependencies, avoiding partial-upgrade behavior.

Quattro recovery after Qt upgrades

• Restore the black Super+Space menu caused by QtQuick 6.12's new Color singleton shadowing Omarchy's palette.
• Generate a content-addressed, verified shell overlay that pins affected QML imports to QtQuick 6.11 without downgrading Qt or modifying the pristine, pinned upstream runtime.
• Use Quattro-only quickshell/qs wrappers to keep launch, IPC, and kill paths consistent; preserve executable helper permissions.
• Add seven rootless regression tests, GitHub CI coverage, an explicit Python dependency, and recovery/rollback documentation.
• Record the previously verified Omarchy Quickshell rebuild and keep Qt ABI checks strict.
• Preserve the user's transparent-bar preference in a separate commit.

Commits

• 09594d3 — feat(arch): establish reproducibility baseline
• 03c2182 — fix(quattro): restore shell menus after Qt upgrades
• ab479d3 — style(quattro): preserve transparent bar preference

Validation

• User confirmed the black-menu issue is fixed on the active workstation.
• Visible Omarchy menu verified; no new undefined-color rendering errors; compositor and applications kept running.
• Seven Quattro overlay/wrapper regression tests and Kitty compatibility tests passed.
• ShellCheck, profile resolver tests, 16 profile manifests, two host manifests, and two reference dossiers passed.
• Six isolated profile rebuilds passed; live Quattro profile doctor reports 25/25 checks.
• Both push-triggered GitHub Lint runs passed.
• PR-specific Lint, pinned-toolchain Chezmoi Pilot, and GitGuardian security checks passed.
• All three OpenSpec changes passed strict validation.
• Upstream Omarchy checkout remains clean; feature branch and remote are synchronized.
• Obtain an explicit merge decision before integrating into main and deleting the branch.

Known limitation / follow-up

The installed quickshell-git ...-3 binary was built against Qt 6.11.2, while this host now runs Qt 6.12. The official Omarchy stable repository still publishes that same rebuild as of 2026-10-08. The menu-rendering regression is fixed independently, but check-runtime deliberately continues reporting the binary compatibility warning. A verified Qt 6.12 rebuild is still a follow-up; this PR does not suppress the warning or claim full runtime health.

Upstream rendering issue: omacom/omarchy#14548.

The workstation's historical Chezmoi pilot recheck also reports local tool drift (chezmoi 2.73.0 vs the evaluation's pinned 2.72.0), and its generated-docs check rejects target permissions. The PR-specific pilot CI uses the pinned evaluation toolchain and passed; local tools and recorded historical evidence were not changed to hide this discrepancy.

Merge / branch cleanup

The branch is three commits ahead of main and is not behind main at PR creation. Merge only after review and an explicit user decision; delete the feature branch only after its contents are confirmed in main.