Merged

ryanrhughes proposed and merged the full device approval rollback into quattro. It removes the approval feature and includes a migration for machines that enabled it, rather than merely hiding its menus. The committed record includes boot rebuild verification, Thunderbolt journal recovery and checks for Omarchy ownership of USBGuard. omacom/omarchy#15091 omacom/omarchy@defbf90e893e

greptile-apps[bot] raised risks involving removal of independently configured USB protection, failed boot rebuilds and boot partitions outside the usual location. The current proposal description records safeguards for these cases: ownership evidence before USBGuard removal, a pending marker until rebuilt entries are verified, and use of the configured boot partition. That description was edited after coverage; it supplies current context for the merged rollback.