Bound running browser policy refreshes

[Drecullith]

Summary

Prevent Chromium-family policy refreshes from blocking theme changes or Omarchy updates indefinitely.

omarchy-theme-set-browser refreshes the platform policy of each running Chromium-family browser after writing the theme policy:

"$command" --refresh-platform-policy --no-startup-window

That invocation is currently unbounded.

On the affected system, a genuinely running Chromium instance did not hand the refresh request to the existing browser and exit. Instead, the command started another long-lived browser process and never returned. Because omarchy-theme-set-browser is reached from theme refresh migrations, this can leave omarchy update permanently stuck waiting for the browser.

This change treats the live refresh as the best-effort operation it is:

• bounds each refresh to 10 seconds;
• uses Omarchy's existing timeout --kill-after pattern so a process that ignores TERM cannot remain stuck indefinitely;
• ignores refresh timeout/failure because the browser policy has already been written and will be picked up later;
• preserves failures from the actual policy write;
• prevents Chrome's fallback binary from being attempted merely because an installed browser's refresh timed out.

The browser refresh now runs as:

timeout --kill-after=1s 10s "$command" \
  --refresh-platform-policy --no-startup-window &>/dev/null || true

No updater signal-trap changes are included. The issue reporter's follow-up testing retracted that separate suggestion; the bounded browser invocation is sufficient for the hang addressed here.

Fixes #10636.

Tests

Added test/shell.d/theme-browser-refresh-test.sh covering:

• Chromium refreshes are hard-bounded;
• Chrome refreshes are hard-bounded;
• Edge refreshes are hard-bounded;
• Brave refreshes are hard-bounded;
• Brave Origin refreshes are hard-bounded;
• a timed-out installed Chrome refresh does not launch the fallback binary;
• browser refresh timeouts do not fail the theme update;
• an actual browser-policy write failure still propagates.

The focused regression test passes.

Also verified:

• bash -n bin/omarchy-theme-set-browser
• bash -n test/shell.d/theme-browser-refresh-test.sh