fix(moonup): read prompts from /dev/tty, robust GUI pause

Pacman/paru can drain or close stdin, so after the first interactive step
the EXIT trap's pause was silently skipped (the `-t 0` check failed) and
every subsequent confirm() prompt hit EOF — which with `[[ -z $response ]]`
auto-accepted, letting install/remove actions run unattended.

- _pause_on_exit: drop the `-t 0` guard and read from /dev/tty
- confirm(): read from /dev/tty so EOF on stdin can't masquerade as "yes"
- Move the trap installation above the gettext i18n init so an early
  failure (e.g. missing gettext) still triggers the pause message.

scripts/moonarch-update

@@ -4,13 +4,6 @@
 
 set -euo pipefail
 
-# --- i18n ---
-# Reuse pacman's gettext catalog for prompts that match upstream msgids.
-# For moonarch-specific strings fall back to _t() inline translation.
-export TEXTDOMAIN=pacman
-export TEXTDOMAINDIR=/usr/share/locale
-YN=$(gettext "[Y/n]")
-
 _t() {
     # _t "english" "deutsch" — picks by $LANG
     case "${LANG%%.*}" in
@@ -21,19 +14,27 @@ _t() {
 
 # Pause on exit when launched from a GUI (Waybar sets MOONUP_WAIT=1).
 # Runs via trap so it fires even when `set -e` aborts the script mid-way.
+# Reads from /dev/tty because stdin may have been drained/closed by pacman/paru.
 _pause_on_exit() {
     local rc=$?
-    if [[ -n "${MOONUP_WAIT:-}" && -t 0 ]]; then
+    if [[ -n "${MOONUP_WAIT:-}" ]]; then
         echo
         if (( rc != 0 )); then
             echo -e "\e[1;31m[Moonarch ERROR]\e[0m $(_t "Exited with error (code $rc)" "Mit Fehler beendet (Code $rc)")" >&2
         fi
-        read -n 1 -s -r -p "$(_t "Press any key to close..." "Beliebige Taste drücken zum Schließen …")" || true
+        read -n 1 -s -r -p "$(_t "Press any key to close..." "Beliebige Taste drücken zum Schließen …")" < /dev/tty || true
         echo
     fi
 }
 trap _pause_on_exit EXIT
 
+# --- i18n ---
+# Reuse pacman's gettext catalog for prompts that match upstream msgids.
+# For moonarch-specific strings fall back to _t() inline translation.
+export TEXTDOMAIN=pacman
+export TEXTDOMAINDIR=/usr/share/locale
+YN=$(gettext "[Y/n]")
+
 # --- Helper functions ---
 
 log() {
@@ -49,7 +50,9 @@ read_packages() {
 }
 
 confirm() {
-    read -r -p ":: $1 $YN " response
+    # Read from /dev/tty so stdin state (drained by pacman/paru, closed by
+    # a Waybar launch) doesn't auto-confirm prompts by returning empty input.
+    read -r -p ":: $1 $YN " response < /dev/tty
     [[ -z "$response" || "$response" =~ ^[yYjJ]$ ]]
 }