batsaver: switch to pkexec helper, drop broken udev permission hack

The wheel-write-via-udev approach for charge_control_end_threshold has
been broken since 2026-04-08: the audit-remediation commit added
ACTION=="add" to the rule, but the threshold attribute doesn't exist
yet at the add event on Lenovo, so chmod fails silently and permissions
are never set. moonarch-batsaver-toggle has been returning Permission
denied since.

Replace the udev-rule approach with a pkexec helper:

  defaults/bin/moonarch-batsaver-apply    privileged: validate + write
  defaults/bin/moonarch-batsaver-toggle   user: read sysfs, dispatch via pkexec
  defaults/bin/moonarch-batsaver-restore  boot-time root restore (extracted
                                          from inline ExecStart for clarity)

Default Standard-pkexec prompt — password cached per session for the
~5min auth window; no polkit no-password rule, no privilege escalation
surface from misvalidated input. Same pattern Battery-Health-Charging
GNOME extension uses.

The boot-time restore service now skips the kernel write when the
sysfs value already matches the saved state (Lenovo drivers reject
same-value writes with EINVAL).

DECISIONS.md documents the failure analysis and trade-offs.
CLAUDE.md updated to describe the new flow.
moonarch-doctor: udev-effectiveness check removed.

scripts/moonarch-doctor

@@ -168,18 +168,8 @@ for svc in NetworkManager bluetooth greetd systemd-timesyncd ufw auto-cpufreq; d
 done
 
 # Battery conservation service (laptop only)
-THRESHOLD_FILE="/sys/class/power_supply/BAT0/charge_control_end_threshold"
-if [[ -f "$THRESHOLD_FILE" ]]; then
+if [[ -f /sys/class/power_supply/BAT0/charge_control_end_threshold ]]; then
     check_system_service moonarch-batsaver
-
-    # Verify udev rule effectiveness — file must be group=wheel and group-writable
-    THRESHOLD_GROUP=$(stat -c '%G' "$THRESHOLD_FILE")
-    THRESHOLD_PERMS=$(stat -c '%a' "$THRESHOLD_FILE")
-    if [[ "$THRESHOLD_GROUP" == "wheel" ]] && [[ "${THRESHOLD_PERMS:1:1}" -ge 6 ]]; then
-        pass "battery threshold writable by wheel (udev rule active)"
-    else
-        fail "battery threshold not writable by wheel (group=$THRESHOLD_GROUP, mode=$THRESHOLD_PERMS — udev rule not applied)"
-    fi
 else
     pass "moonarch-batsaver (skipped — no battery threshold support)"
 fi