One password covers the whole Omarchy update
A change merged into quattro keeps the sudo authorization from the start of omarchy update through AUR builds and the boot check. The timestamp is revoked when the boot check finishes, and again on every exit.
omarchy update asked for the sudo password at the start, then revoked that authorization before updating AUR packages and before the boot check. Those phases ran sudo through the no-update wrapper, so a machine with AUR packages, or a Mac with a boot package, was prompted again near the end of an update the user had already authorized.
The one authorization at the start covers every step, and the keepalive keeps it fresh until the boot check finishes. omarchy-channel-set, omarchy-refresh-pacman and stay-awake outside an update keep their own cold boundaries. The change deliberately lets AUR PKGBUILD code run while the update's sudo timestamp is live, which the previous design existed to prevent.