fix: audit LOW fixes — nmcli guards, sink cancel, cpugov stderr, gpu interval

- moonarch-vpn: add `--` argument-terminator to `nmcli connection up/down`
  so a profile name starting with `-` is never interpreted as a flag.
- moonarch-sink-switcher: guard against empty `$sink` when walker is
  cancelled, since awk masks walker's non-zero exit. Prevents the error
  `pactl set-default-sink ""` on every dismissal.
- moonarch-waybar-cpugov: redirect stderr so non-cpufreq systems (VMs,
  some desktops) do not spam the journal on every 60s poll.
- waybar config: switch custom/gpu-usage from `restart-interval: 10` to
  `interval: 60`. The module lives in a closed drawer, a 10 s poll spawn
  was unnecessary background noise.

defaults/bin/moonarch-vpn

@@ -39,13 +39,13 @@ function extract_connection_name() {
 # Requires nm-applet (or another NM secret agent) for interactive auth.
 function connect_vpn() {
     local connection="$1"
-    nmcli connection up "$connection"
+    nmcli connection up -- "$connection"
 }
 
 # Disconnect a VPN.
 function disconnect_vpn() {
     local connection="$1"
-    nmcli connection down "$connection"
+    nmcli connection down -- "$connection"
 }
 
 # Toggle the VPN connection based on its current state.