fix: audit remediation — 6 fixes across quality, performance, security

Q-01: Fix broken upower regex in moonarch-btnote (lookaheads never matched)
Q-02: Fix transform.sh paru repo section name ([moonarch] → [moonarch-pkgbuilds]),
      config path (~/.config → /etc), and partial sync (-Sy → -Syu)
Q-03: Add missing stasis package to aur.txt (idle management broken on fresh install)
S-01: Switch CI git clones from HTTP to HTTPS (MITM risk in Docker network)
S-02: Restrict CI builder sudo to /usr/bin/pacman only
P-01: Refactor moonarch-waybar-gpustat — remove while loop, use jq --arg style

defaults/bin/moonarch-btnote

@@ -8,9 +8,8 @@ ICON="battery-empty"
 while IFS= read -r d; do
   [ -z "$d" ] && continue
   DEVICE_DATA=$(upower -i "$d")
-  PERCENTAGE=$(echo "$DEVICE_DATA" | grep -Po '(?<=(percentage: )).*(?= icon)')
-  PER_INT=$(echo "${PERCENTAGE//%}")
-  DEVICE_NAME=$(echo "$DEVICE_DATA" | grep -Po '(?<=(model: )).*(?= serial)')
+  PER_INT=$(echo "$DEVICE_DATA" | grep -oP 'percentage:\s+\K[0-9]+')
+  DEVICE_NAME=$(echo "$DEVICE_DATA" | grep -oP 'model:\s+\K.+')
 
   if [ -n "$DEVICE_NAME" ] && [ -n "$PER_INT" ] && [ "$PER_INT" -lt "$NOTIFY_AT_PERCENTAGE" ]; then
     notify-send -t 5000 -e "Low battery $DEVICE_NAME $PER_INT%" -i "$ICON" \