Route sibling-package omarchy-* commands via a /usr/bin fallback (fixes #7185)

[WhiskeyTuesday]

Fixes #7185. Adjacent to #6977 and #7060 (both symptoms of the same split).

Problem

bin/omarchy resolves subcommands by globbing its own directory (OMARCHY_BIN_DIR), so on a production install it only sees /usr/share/omarchy/bin. Sibling packages install their own omarchy-* binaries into /usr/bin without symlinking them into /usr/share/omarchy/bin, which puts every one of their routes out of the dispatcher's reach. Today that hides at least five commands — three from omarchy-settings (omarchy-debug, omarchy-debug-idle, omarchy-upload-log) and two from omarchy-nvim (omarchy-nvim-setup, omarchy-nvim-refresh) — and every optional package following the same pattern (omarchy-emacs, omarchy-fish, omarchy-zsh, future ones) hits the same wall. The three from omarchy-settings are the most user-visible because the bug template and the shipped omarchy agent skill both instruct people to run omarchy debug --no-sudo --print, which currently exits 127 on production installs.

The split is deliberate on the packaging side (omarchy-settings must be usable on the ISO live env before omarchy is installed), so bin/omarchy's PKGBUILD deliberately excludes those three from the standard install -Dm755 … + ln -s /usr/share/omarchy/bin/… loop. Fixing this on the dispatcher side keeps the invariant in one place instead of asking every sibling-package PKGBUILD to remember to drop a symlink into a directory another package owns.

Change

When the dispatcher runs as a production install (OMARCHY_BIN_DIR == /usr/share/omarchy/bin), also scan /usr/bin/omarchy-* as a secondary source. The primary directory always wins on name collision, so the omarchy package's own binaries stay authoritative.

The touch points are the six discovery/resolution paths in bin/omarchy — load_commands, load_command_by_binary, load_child_commands_by_binary, group_has_child_commands, group_has_binary_commands, load_group_commands, resolve_direct_route — plus the two binary_path= sites in dispatch_fast_or_help/dispatch_or_help and the missing-binary check in commands --check. All of those funnel through a single resolve_binary_path helper (primary first, then secondary), and resolve_direct_route now returns DIRECT_RESOLVED_PATH so the fast path can exec the right file without recomputing.

Dev-link and test invocations honour the env variable OMARCHY_SECONDARY_BIN_DIR themselves — set it to a directory to override, set it to the empty string to disable the fallback. The tests use that seam to drive the new code paths against scratch directories rather than /usr/bin.

Metadata check behavior

Once sibling-package binaries become visible to the dispatcher, they also become visible to omarchy commands --check. omarchy-nvim's two binaries ship without an # omarchy:summary= line today, so a strict check regressed from green to red on any machine with omarchy-nvim installed.

To avoid pinning the fix to a coordinated release with a sibling package, commands --check now tracks per-command origin (primary vs secondary). Missing-summary and metadata-validation errors from primary binaries still fail the check exactly as before — that guardrail on the project's own tree is untouched. The same errors from secondary binaries surface as warnings with a (foreign) tag and do not count toward the failure total. Missing-binary errors continue to fail regardless of origin. Happy to invert that decision if the preference is to fail hard and use it as pressure to fix sibling-package metadata.

Tests

test/cli gains a block that reuses the existing symlink-into-tmpdir pattern:

• secondary-only top-level command dispatches and forwards args
• secondary-only child of a shared group dispatches
• group help renders and lists secondary-only children
• commands --all --json lists secondary-dir commands
• commands --check passes when a well-formed command lives only in secondary
• primary wins on name collision, no shadow execution, no double-register
• empty OMARCHY_SECONDARY_BIN_DIR disables the fallback
• foreign missing-summary is a warning, not a failure
• primary-tree missing-summary still fails the check (regression guard)

Full suite is green (bash test/cli — 126 tests pass).

Verification against the real system

With OMARCHY_SECONDARY_BIN_DIR=/usr/bin (i.e. simulating a production install from a dev checkout), the previously-invisible routes now resolve on my machine:

$ OMARCHY_SECONDARY_BIN_DIR=/usr/bin ./bin/omarchy commands --all | grep -E '^  omarchy (debug|upload log|nvim setup|nvim refresh|debug idle)'
  omarchy debug idle [log-lines]         Show idle, screensaver, and lock diagnostics
  omarchy debug [--no-sudo] [--print]    Print debugging information
  omarchy nvim refresh                    Setup/refresh script for omarchy-nvim
  omarchy nvim setup                      Setup/refresh script for omarchy-nvim
  omarchy upload log <log-file>           Upload logs to logs.omarchy.org

$ OMARCHY_SECONDARY_BIN_DIR=/usr/bin ./bin/omarchy debug --help
Usage:
  omarchy debug [--no-sudo] [--print]
...

$ OMARCHY_SECONDARY_BIN_DIR=/usr/bin ./bin/omarchy commands --check
Missing metadata summary (foreign): omarchy-nvim-refresh
Missing metadata summary (foreign): omarchy-nvim-setup
Command metadata check passed (439 commands)

Relationship to #7239

PR #7239 (open, targets default/hypr/envs.lua) fixes the PATH-shadowing side of #6977 — with it landed, an interactive shell in Hyprland has /usr/bin ahead of /usr/share/omarchy/bin on PATH, so omarchy resolves from /usr/bin/omarchy, and that dispatcher then scans /usr/bin/omarchy-* and finds everything. It functionally papers over #7185 for interactive shells. This PR fixes the dispatcher itself, so any invocation of /usr/share/omarchy/bin/omarchy debug (scripts, non-interactive shells, scoped OMARCHY_PATH uses) also routes correctly. The two are orthogonal — either can land first.