v1.2.1 — omac installer

• load-lock install --harness omac (+ uninstall): merge-only, idempotent, reversible edit of omac's user-global sandbox profile (~/.config/omac/sandbox-profiles/default.json) — grants AF_UNIX connect to the host daemon socket (filesystem.allow_unix_dir), the installed package tree when needed (filesystem.read), and passes all LOAD_LOCK_* client vars through the sandbox env filter (environment.allow_vars) (#32)
• omac recipe in the Sandboxes docs upgraded from contract-inspected to live-verified against omac 0.11.0 (bubblewrap + Landlock), including both gotchas: the package-tree read grant a global install needs, and the daemon >= 1.2.0 requirement for label prefixes (#32)
• 5 new omac installer contract tests (populated-profile preservation, idempotent re-install, missing-profile creation, global-install read grant, broken-profile refusal)

Tests: 125/125 green.