Drop pacstall, use pinned binary tarball + topgrade update hook

Pacstall tried to BUILD neovim from source (downloaded the v0.12.2
tarball and ran the build chain). On a Pi this is 5+ minutes plus
fragile — pacstall's connection broke during download.

Switch to direct binary tarball install:

1. Pinned to NVIM_TARGET_VERSION='v0.11.4' in two places:
   - run_once_20-install-user-packages.sh.tmpl (initial install)
   - dot_local/bin/update-neovim.sh (topgrade-time updates)

2. Both use the same install logic: detect arch via uname -m, download
   the right tarball (nvim-linux-arm64.tar.gz for aarch64), extract
   to /opt, symlink /usr/local/bin/nvim. Idempotent — if installed
   version == target, no-op.

3. Topgrade config has a [commands] entry that runs the update script
   after system updates. To upgrade neovim across all boxes: edit
   NVIM_TARGET_VERSION in dot_local/bin/update-neovim.sh, commit,
   push, run topgrade.

4. Removed run_once_05-install-pacstall.sh.tmpl entirely — pacstall
   isn't worth the install footprint for one package.

dot_config/topgrade/topgrade.toml

@@ -1,6 +1,6 @@
 # =============================================================================
 #  topgrade.toml — chezmoi-managed
-#  Most steps (system, pacstall, flatpak, snap, cargo, npm, pyenv, rustup, etc.)
+#  Most steps (system, flatpak, snap, cargo, npm, pyenv, rustup, etc.)
 #  are auto-detected by topgrade when their binaries are on $PATH. Only set
 #  custom config here.
 # =============================================================================
@@ -14,4 +14,9 @@ pre_sudo = true
 ignore_failures = ["node"]
 
 # Print the time in step titles for verbose output.
-display_time = true
+display_time = true
+
+[commands]
+# Bump neovim to the version pinned in update-neovim.sh. Idempotent — no-op
+# if already at target. Edit NVIM_TARGET_VERSION in the script to upgrade.
+"~/.local/bin/update-neovim.sh" = "neovim"