Drop pacstall, use pinned binary tarball + topgrade update hook

Pacstall tried to BUILD neovim from source (downloaded the v0.12.2
tarball and ran the build chain). On a Pi this is 5+ minutes plus
fragile — pacstall's connection broke during download.

Switch to direct binary tarball install:

1. Pinned to NVIM_TARGET_VERSION='v0.11.4' in two places:
   - run_once_20-install-user-packages.sh.tmpl (initial install)
   - dot_local/bin/update-neovim.sh (topgrade-time updates)

2. Both use the same install logic: detect arch via uname -m, download
   the right tarball (nvim-linux-arm64.tar.gz for aarch64), extract
   to /opt, symlink /usr/local/bin/nvim. Idempotent — if installed
   version == target, no-op.

3. Topgrade config has a [commands] entry that runs the update script
   after system updates. To upgrade neovim across all boxes: edit
   NVIM_TARGET_VERSION in dot_local/bin/update-neovim.sh, commit,
   push, run topgrade.

4. Removed run_once_05-install-pacstall.sh.tmpl entirely — pacstall
   isn't worth the install footprint for one package.

dot_local/bin/update-neovim.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  update-neovim.sh — chezmoi-managed, deployed to ~/.local/bin/update-neovim.sh
+#
+#  Installs or upgrades neovim from the official binary tarball.
+#  Bump NVIM_TARGET_VERSION to upgrade. Topgrade calls this via
+#  ~/.config/topgrade.toml.
+#
+#  Idempotent: no-op if installed version matches target.
+# =============================================================================
+set -euo pipefail
+
+NVIM_TARGET_VERSION="v0.11.4"
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+    x86_64)        NVIM_TARBALL="nvim-linux64.tar.gz" ;;
+    aarch64|arm64) NVIM_TARBALL="nvim-linux-arm64.tar.gz" ;;
+    *)
+        echo "unsupported arch: $ARCH" >&2
+        exit 1
+        ;;
+esac
+
+if command -v nvim >/dev/null 2>&1; then
+    INSTALLED_VER="$(nvim --version 2>/dev/null | head -1 | awk '{print $2}')"
+    if [[ "$INSTALLED_VER" == "$NVIM_TARGET_VERSION" ]]; then
+        echo "neovim $INSTALLED_VER matches target — no action"
+        exit 0
+    fi
+    echo "neovim $INSTALLED_VER -> $NVIM_TARGET_VERSION"
+else
+    echo "installing neovim $NVIM_TARGET_VERSION"
+fi
+
+cd /tmp
+TMP_TARBALL="$(mktemp /tmp/nvim-update.XXXXXX.tar.gz)"
+trap 'rm -f "$TMP_TARBALL"' EXIT
+
+if ! curl -fL --retry 3 \
+    "https://github.com/neovim/neovim/releases/download/${NVIM_TARGET_VERSION}/${NVIM_TARBALL}" \
+    -o "$TMP_TARBALL"; then
+    echo "failed to download $NVIM_TARBALL" >&2
+    exit 1
+fi
+
+sudo rm -rf /opt/nvim-linux* /usr/local/bin/nvim
+sudo tar -xzf "$TMP_TARBALL" -C /opt/
+sudo ln -sf "/opt/$(basename "$TMP_TARBALL" .tar.gz)/bin/nvim" /usr/local/bin/nvim
+
+echo "neovim $NVIM_TARGET_VERSION installed"
+nvim --version | head -1