fix: audit remediation — 6 fixes across quality, performance, security

Q-01: Fix broken upower regex in moonarch-btnote (lookaheads never matched)
Q-02: Fix transform.sh paru repo section name ([moonarch] → [moonarch-pkgbuilds]),
      config path (~/.config → /etc), and partial sync (-Sy → -Syu)
Q-03: Add missing stasis package to aur.txt (idle management broken on fresh install)
S-01: Switch CI git clones from HTTP to HTTPS (MITM risk in Docker network)
S-02: Restrict CI builder sudo to /usr/bin/pacman only
P-01: Refactor moonarch-waybar-gpustat — remove while loop, use jq --arg style

scripts/transform.sh

@@ -247,19 +247,16 @@ trap - EXIT
 
 # Moonarch custom paru repo
 log "Setting up Moonarch paru repo..."
-PARU_CONF="$HOME/.config/paru/paru.conf"
-mkdir -p "$(dirname "$PARU_CONF")"
-if ! grep -q '\[moonarch\]' "$PARU_CONF" 2>/dev/null; then
-    cat >> "$PARU_CONF" <<'EOCONF'
-[moonarch]
-Url = https://gitea.moonarch.de/nevaforget/moonarch-pkgbuilds.git
-EOCONF
+PARU_CONF="/etc/paru.conf"
+if ! grep -q '\[moonarch-pkgbuilds\]' "$PARU_CONF" 2>/dev/null; then
+    printf '\n[moonarch-pkgbuilds]\nUrl = https://gitea.moonarch.de/nevaforget/moonarch-pkgbuilds.git\n' \
+        | sudo tee -a "$PARU_CONF" > /dev/null
     log "  + Moonarch repo added to paru.conf."
 else
     log "  ~ Moonarch repo already in paru.conf."
 fi
 
-paru -Sy --pkgbuilds --noconfirm
+paru -Syu --pkgbuilds --noconfirm
 
 log "Installing moonarch-git package..."
 paru -S --needed --noconfirm moonarch-git