fix: shell script quoting and argument injection hardening

Audit fixes for command injection risks in helper scripts:
- moonarch-cpugov: eval for quoted COMMANDS expansion (pkexec context)
- moonarch-btnote: while+read with process substitution, quoted vars
- moonarch-vpn: -- guard before connection name in nmcli calls
- post-install.sh: else-logging when USER_DEFAULTS dir missing

defaults/bin/moonarch-vpn

@@ -41,7 +41,7 @@ function connect_vpn() {
     local connection="$1"
     local feedback
 
-    if feedback=$(nmcli connection up "$connection" 2>&1); then
+    if feedback=$(nmcli connection up -- "$connection" 2>&1); then
         notify-send "VPN" "Connected to '$connection'"
     else
         notify-send -u critical "VPN" "Connection failed: $feedback"
@@ -53,7 +53,7 @@ function disconnect_vpn() {
     local connection="$1"
     local feedback
 
-    if feedback=$(nmcli connection down "$connection" 2>&1); then
+    if feedback=$(nmcli connection down -- "$connection" 2>&1); then
         notify-send "VPN" "Disconnected from '$connection'"
     else
         notify-send -u critical "VPN" "Disconnect failed: $feedback"