Capture omarchy-air's post-10-16 customizations into its layer

Everything on the Air that existed only on the machine:

- git/config and mimeapps.list, which the omarchy-air-host branch captured
  but profiles never picked up.
- NetBird: netbird-bin under [aur], the networkd drop-in it writes, and a
  setup.sh that runs `netbird service install` and enables the unit (the AUR
  package ships none). `netbird up` stays manual.
- ufw rules beyond Omarchy's stock set and the handoff step's 4242 rule:
  ssh and the ocovo fabric (7746/udp) from the home LAN, 7746 over wt0, and
  7790/tcp.

base gains omarchy-fix-qt-color and a setup.sh that runs it. Qt 6.12's
QtQuick Color singleton shadows the shell's qs.Commons Color, so the bar,
lock screen and polkit dialog lose every colour; the fix renames the
singleton to ShellColor. An omarchy upgrade restores the stock files, so it
is idempotent, skips Qt < 6.12, and no-ops once upstream renames it.
Verified: run against the pristine backup it reproduces the Air's
hand-patched /usr/share/omarchy/shell byte for byte.

Left out on purpose: ocovo-node.service (written by `ocovo service
install`) and environment.d/ohv.conf belong to those projects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

profiles/machines/macbook-air-m2/config/git/config

@@ -0,0 +1,39 @@
+# See https://git-scm.com/docs/git-config
+
+[alias]
+	co = checkout
+	br = branch
+	ci = commit
+	st = status
+[init]
+	defaultBranch = main
+[pull]
+	rebase = true
+[push]
+	autoSetupRemote = true   # Automatically set upstream branch on push
+[diff]
+	algorithm = histogram    # Clearer diffs on moved/edited lines
+	colorMoved = plain       # Highlight moved blocks in diffs
+	mnemonicPrefix = true    # More intuitive refs in diff output
+[commit]
+	verbose = true           # Include diff comment in commit message template
+[column]
+	ui = auto 			     # Output in columns when possible
+[branch]
+	sort = -committerdate    # Sort branches by most recent commit first
+[tag]
+	sort = -version:refname  # Sort version numbers as you would expect
+[rerere]
+	enabled = true           # Record and reuse conflict resolutions
+	autoupdate = true        # Apply stored conflict resolutions automatically
+[user]
+	name = Nic O'Connor
+	email = nic.oconnor@gmail.com
+[fetch]
+	prune = true
+[credential]
+	helper = /usr/lib/git-core/git-credential-libsecret
+[credential "https://git.nic-oconnor.com"]
+	helper = 
+	helper = "!f() { test \"$1\" = get && test -n \"${GITEA_KEY:-}\" && printf \"username=%s\\npassword=%s\\n\" \"${GITEA_USER:-$(id -un)}\" \"$GITEA_KEY\"; }; f"
+	helper = /usr/lib/git-core/git-credential-libsecret