Capture omarchy-air's post-10-16 customizations into its layer

Everything on the Air that existed only on the machine:

- git/config and mimeapps.list, which the omarchy-air-host branch captured
  but profiles never picked up.
- NetBird: netbird-bin under [aur], the networkd drop-in it writes, and a
  setup.sh that runs `netbird service install` and enables the unit (the AUR
  package ships none). `netbird up` stays manual.
- ufw rules beyond Omarchy's stock set and the handoff step's 4242 rule:
  ssh and the ocovo fabric (7746/udp) from the home LAN, 7746 over wt0, and
  7790/tcp.

base gains omarchy-fix-qt-color and a setup.sh that runs it. Qt 6.12's
QtQuick Color singleton shadows the shell's qs.Commons Color, so the bar,
lock screen and polkit dialog lose every colour; the fix renames the
singleton to ShellColor. An omarchy upgrade restores the stock files, so it
is idempotent, skips Qt < 6.12, and no-ops once upstream renames it.
Verified: run against the pristine backup it reproduces the Air's
hand-patched /usr/share/omarchy/shell byte for byte.

Left out on purpose: ocovo-node.service (written by `ocovo service
install`) and environment.d/ohv.conf belong to those projects.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

profiles/machines/macbook-air-m2/setup.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+# macbook-air-m2 setup, run by install.sh's `setup` step after the files are in
+# place. Everything here is state outside ~/.config. Idempotent; honours
+# OMARCHY_SETUP_DRY=1.
+set -uo pipefail
+
+run() { if [[ ${OMARCHY_SETUP_DRY:-0} == 1 ]]; then echo "  ? would: $*"; else "$@"; fi; }
+
+# NetBird: the AUR package ships no unit; `netbird service install` writes
+# /etc/systemd/system/netbird.service. Joining the network (`netbird up`) is
+# interactive and stays a manual step.
+if command -v netbird >/dev/null; then
+  if [[ -f /etc/systemd/system/netbird.service ]]; then
+    echo "  = netbird.service installed"
+  else
+    run sudo netbird service install && echo "  + netbird.service"
+  fi
+  if systemctl is-enabled --quiet netbird 2>/dev/null; then
+    echo "  = netbird.service enabled"
+  else
+    run sudo systemctl enable --now netbird && echo "  + netbird.service enabled (now run: netbird up)"
+  fi
+fi
+
+# Firewall, beyond Omarchy's stock rules (LocalSend, Docker DNS) and the 4242
+# lan-mouse rule the handoff step opens per peer:
+#   22/tcp     sshd, from the home LAN (the HP reaches it as `ssh air`)
+#   7746/udp   ocovo fabric, from the home LAN and over NetBird (wt0)
+#   7790/tcp   ocovo, anywhere
+ufw_rule() {
+  if [[ ${OMARCHY_SETUP_DRY:-0} == 1 ]]; then echo "  ? would: ufw $*"; return; fi
+  # ufw reports "Skipping adding existing rule" for a duplicate, so this is idempotent.
+  local out; out=$(sudo ufw "$@" 2>&1)
+  [[ $out == *Skipping* ]] && echo "  = ufw $*" || echo "  + ufw $*"
+}
+if command -v ufw >/dev/null; then
+  if [[ ${OMARCHY_SETUP_DRY:-0} != 1 ]] && ! sudo -n true 2>/dev/null && [[ ! -t 0 ]]; then
+    echo "  ! sudo needs a password and there is no terminal; ufw rules not applied"
+  else
+    ufw_rule allow from 192.168.1.0/24 to any port 22 proto tcp
+    ufw_rule allow from 192.168.1.0/24 to any port 7746 proto udp comment 'ohv fabric'
+    ufw_rule allow in on wt0 to any port 7746 proto udp
+    ufw_rule allow 7790/tcp
+  fi
+fi