fix: audit MEDIUM fixes — merge fallback, service hardening, CI token

- moonarch-waybar: on merge failure, remove the stale output so waybar
  falls back to the system config (previously it kept running with stale
  merged data despite the error notification claiming otherwise).
- moonarch-doctor: hoist INSTALLED assignment above both OFFICIAL and AUR
  blocks so the script survives set -u when only aur.txt is present.
- zshrc parse_git_branch: gate on git rev-parse and replace three grep
  subshells with bash pattern matching, cutting prompt latency from
  ~5 subprocesses per render to 2 (status + symbolic-ref).
- moonarch-batsaver.service: validate the threshold is an integer 1-100
  before writing to sysfs, add NoNewPrivileges and protection directives
  instead of relying on kernel validation alone.
- ci/act-runner/Dockerfile: drop the broad "pacman -Sy *" sudoers entry
  (only -S --needed is required by makepkg), and pin run.sh to
  act_runner:0.3.1 so it cannot drift ahead of the pinned binary.
- .gitea/workflows/update-pkgver.yaml: push via credential.helper=store
  with a chmod 600 temp file instead of `git -c http.extraHeader=...`,
  so the token no longer shows up in /proc/PID/cmdline.

.gitea/workflows/update-pkgver.yaml

@@ -21,6 +21,8 @@ jobs:
           echo "$PKGVER" > /tmp/pkgver
 
       - name: Update PKGBUILD
+        env:
+          PKGBUILD_TOKEN: ${{ secrets.PKGBUILD_TOKEN }}
         run: |
           PKGVER=$(cat /tmp/pkgver)
           git clone https://gitea.moonarch.de/nevaforget/moonarch-pkgbuilds.git pkgbuilds
@@ -39,4 +41,12 @@ jobs:
           git config user.email "gitea@moonarch.de"
           git add moonarch-git/PKGBUILD
           git commit -m "chore(moonarch-git): bump pkgver to $PKGVER"
-          git -c http.extraHeader="Authorization: token ${{ secrets.PKGBUILD_TOKEN }}" push
+
+          # Push via credential helper with a chmod 600 temp file, so the token
+          # never appears in /proc/PID/cmdline (as it would with `git -c
+          # http.extraHeader=...`).
+          CRED_FILE=$(mktemp)
+          chmod 600 "$CRED_FILE"
+          trap 'rm -f "$CRED_FILE"' EXIT
+          printf "https://pkgver-bot:%s@gitea.moonarch.de\n" "$PKGBUILD_TOKEN" > "$CRED_FILE"
+          git -c credential.helper="store --file=$CRED_FILE" push