Fix run_once_20 neovim install for aarch64 + always-fallback

Two bugs hit on rye:

1. neovim tarball URL hardcoded to nvim-linux64.tar.gz (x86_64 only).
   On aarch64 boxes (rye is arm64), curl would 404 the tarball, the
   unpack would create a binary that won't run, or apt's bundled
   neovim might not even be installed.

2. The 'apt's neovim is too old' branch only ran if apt had
   successfully installed an old neovim. If apt didn't install
   neovim at all (or installed a recent enough version), the
   tarball fallback never triggered. On rye, the script reached
   the final 'nvim --version' verification line and crashed with
   'command not found'.

Fix:
- Detect arch via uname -m, map to correct tarball name
  (x86_64 -> nvim-linux64.tar.gz, aarch64 -> nvim-linux-arm64.tar.gz)
- If command -v nvim returns false at all, skip the version check
  entirely and go straight to the GitHub tarball
- If apt's neovim IS recent enough (>= 0.9), keep it and skip the
  tarball
- Final 'nvim --version' verification preceded by a PATH-ensure
  for /usr/local/bin in case the freshly-installed tarball binary
  isn't yet on PATH for this script's environment

Verified template renders cleanly on arch.

run_once_20-install-user-packages.sh.tmpl

@@ -62,24 +62,48 @@ if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
     ln -sf "$(command -v fdfind)" "$USER_HOME/.local/bin/fd"
 fi
 
-# Debian's neovim in stable is too old for LazyVim (needs >=0.9).
-# If installed neovim is <0.9, fetch the official binary tarball.
+# Neovim — always install the latest official binary tarball on debian.
+# apt's neovim is too old for LazyVim on stable (bookworm), and even on
+# trixie we want a known-good version. Detect arch for the right tarball.
+ARCH="$(uname -m)"
+case "$ARCH" in
+    x86_64)        NVIM_TARBALL="nvim-linux64.tar.gz" ;;
+    aarch64|arm64) NVIM_TARBALL="nvim-linux-arm64.tar.gz" ;;
+    *)
+        die "unsupported arch for neovim tarball: $ARCH"
+        ;;
+esac
+
 if command -v nvim >/dev/null 2>&1; then
     NVIM_VER="$(nvim --version | head -1 | awk '{print $2}' | tr -d 'v')"
     NVIM_MAJOR="$(echo "$NVIM_VER" | cut -d. -f1)"
     NVIM_MINOR="$(echo "$NVIM_VER" | cut -d. -f2)"
     if [[ "${NVIM_MAJOR:-0}" -lt 1 || ("$NVIM_MAJOR" -eq 0 && "${NVIM_MINOR:-0}" -lt 9) ]]; then
-        log "installed neovim $NVIM_VER is too old, installing official binary"
+        log "installed neovim $NVIM_VER too old — replacing with latest from GitHub ($ARCH)"
         sudo apt-get remove -y neovim || true
-        cd /tmp
-        NVIM_LATEST="$(curl -fsSL https://api.github.com/repos/neovim/neovim/releases/latest | grep tag_name | cut -d'"' -f4)"
-        curl -fL "https://github.com/neovim/neovim/releases/download/${NVIM_LATEST}/nvim-linux64.tar.gz" -o nvim.tar.gz
-        sudo tar -xzf nvim.tar.gz -C /opt/
-        sudo ln -sf /opt/nvim-linux64/bin/nvim /usr/local/bin/nvim
-        rm -f nvim.tar.gz
+    else
+        log "neovim $NVIM_VER from apt is recent enough — keeping it"
+        NVIM_TARBALL=""
     fi
 fi
 
+if [[ -n "$NVIM_TARBALL" ]]; then
+    log "downloading neovim from GitHub ($NVIM_TARBALL)"
+    cd /tmp
+    NVIM_LATEST="$(curl -fsSL https://api.github.com/repos/neovim/neovim/releases/latest | grep tag_name | cut -d'"' -f4)"
+    curl -fL "https://github.com/neovim/neovim/releases/download/${NVIM_LATEST}/${NVIM_TARBALL}" -o nvim.tar.gz
+    sudo rm -rf /opt/nvim-linux* /usr/local/bin/nvim
+    sudo tar -xzf nvim.tar.gz -C /opt/
+    # The arm64 tarball extracts to nvim-linux-arm64, x86_64 to nvim-linux64.
+    sudo ln -sf "/opt/$(basename nvim.tar.gz .tar.gz)/bin/nvim" /usr/local/bin/nvim
+    rm -f nvim.tar.gz
+fi
+
+# Verify neovim is reachable (PATH may need /usr/local/bin explicitly for this run)
+if ! command -v nvim >/dev/null 2>&1 && [[ -x /usr/local/bin/nvim ]]; then
+    export PATH="/usr/local/bin:$PATH"
+fi
+
 {{ else -}}
 die "unsupported os_family: {{ .os_family }}"
 {{ end -}}