fix: audit MEDIUM fixes — merge fallback, service hardening, CI token

- moonarch-waybar: on merge failure, remove the stale output so waybar
  falls back to the system config (previously it kept running with stale
  merged data despite the error notification claiming otherwise).
- moonarch-doctor: hoist INSTALLED assignment above both OFFICIAL and AUR
  blocks so the script survives set -u when only aur.txt is present.
- zshrc parse_git_branch: gate on git rev-parse and replace three grep
  subshells with bash pattern matching, cutting prompt latency from
  ~5 subprocesses per render to 2 (status + symbolic-ref).
- moonarch-batsaver.service: validate the threshold is an integer 1-100
  before writing to sysfs, add NoNewPrivileges and protection directives
  instead of relying on kernel validation alone.
- ci/act-runner/Dockerfile: drop the broad "pacman -Sy *" sudoers entry
  (only -S --needed is required by makepkg), and pin run.sh to
  act_runner:0.3.1 so it cannot drift ahead of the pinned binary.
- .gitea/workflows/update-pkgver.yaml: push via credential.helper=store
  with a chmod 600 temp file instead of `git -c http.extraHeader=...`,
  so the token no longer shows up in /proc/PID/cmdline.

defaults/bin/moonarch-waybar

@@ -51,7 +51,9 @@ if [[ -f "$USERCONFIG" ]]; then
     if [[ ! -f "$OUTPUT" ]] ||
        [[ "$USERCONFIG" -nt "$OUTPUT" ]] ||
        [[ "$SYSTEM_CONFIG" -nt "$OUTPUT" ]]; then
-        merge_config
+        # On merge failure the previous $OUTPUT is stale — remove it so waybar
+        # falls back to XDG's system config instead of running with stale merged data.
+        merge_config || rm -f "$OUTPUT"
     fi
     bootstrap_style
 fi