v44.49

Native app install now works after Update

Root cause (operator-confirmed, NOT uid-1001): regular Docker apps install fine, but native apps run host `sudo -n apt-get install` which needs the `/etc/sudoers.d/livos-native` NOPASSWD grant — and `update.sh` never installed it (only the first-time `deploy-livinityd.sh` did). So on every box that updates via update.sh, native installs were silently refused with `sudo_denied`.

Fixed

• update.sh — new idempotent native-provisioning step: installs `/etc/sudoers.d/livos-native` (templated to the box's desktop user, `visudo -cf` validated with rollback on failure) + copies `livos-add-apt-repo.sh` → `/usr/local/lib/livos/` (was never copied anywhere → apt-repo apps like Brave/Signal/Spotify were broken too).
• deploy-livinityd.sh — mirrors the apt-repo helper copy so fresh installs get it too.
• handleInstallV37 (store bridge) — native/v37 install failures now `console.error` to the LivOS host console instead of only the cross-origin iframe, so failures stop being silent.

After Update

Native apps (GIMP, etc.) install end-to-end → desktop tile → per-app window. Confirm on the box: `ls -l /etc/sudoers.d/livos-native` now exists; `sudo -n /usr/bin/apt-get install -y gimp` no longer says "password required".

Gates

`bash -n update.sh`/`deploy-livinityd.sh` clean · livinityd tsc=305 · `pnpm --filter ui build` exit 0 · no DB migration. Idempotent + de-hardcoded (no literal user).

(Store Wave 1 — responsive + immediate-load + remove MCP/AI tab — already shipped via Vercel.)

Full Changelog: v44.48...v44.49