Drop pacstall, use pinned binary tarball + topgrade update hook

Pacstall tried to BUILD neovim from source (downloaded the v0.12.2
tarball and ran the build chain). On a Pi this is 5+ minutes plus
fragile — pacstall's connection broke during download.

Switch to direct binary tarball install:

1. Pinned to NVIM_TARGET_VERSION='v0.11.4' in two places:
   - run_once_20-install-user-packages.sh.tmpl (initial install)
   - dot_local/bin/update-neovim.sh (topgrade-time updates)

2. Both use the same install logic: detect arch via uname -m, download
   the right tarball (nvim-linux-arm64.tar.gz for aarch64), extract
   to /opt, symlink /usr/local/bin/nvim. Idempotent — if installed
   version == target, no-op.

3. Topgrade config has a [commands] entry that runs the update script
   after system updates. To upgrade neovim across all boxes: edit
   NVIM_TARGET_VERSION in dot_local/bin/update-neovim.sh, commit,
   push, run topgrade.

4. Removed run_once_05-install-pacstall.sh.tmpl entirely — pacstall
   isn't worth the install footprint for one package.

run_once_20-install-user-packages.sh.tmpl

@@ -62,50 +62,41 @@ if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
     ln -sf "$(command -v fdfind)" "$USER_HOME/.local/bin/fd"
 fi
 
-# Neovim — install via pacstall on debian (auto-updated by topgrade via
-# built-in pacstall step). Falls back to GitHub tarball if pacstall isn't
-# available for some reason.
-if command -v pacstall >/dev/null 2>&1; then
-    if ! command -v nvim >/dev/null 2>&1; then
-        log "installing neovim via pacstall"
-        sudo pacstall -I neovim
+# Neovim — install official binary tarball, pinned to a known-good version.
+# Bump NVIM_TARGET_VERSION to upgrade. ~/.local/bin/update-neovim.sh does
+# the same check + download so topgrade can invoke it for upgrades.
+NVIM_TARGET_VERSION="v0.11.4"
+ARCH="$(uname -m)"
+case "$ARCH" in
+    x86_64)        NVIM_TARBALL="nvim-linux64.tar.gz" ;;
+    aarch64|arm64) NVIM_TARBALL="nvim-linux-arm64.tar.gz" ;;
+    *)
+        die "unsupported arch for neovim tarball: $ARCH"
+        ;;
+esac
+
+if command -v nvim >/dev/null 2>&1; then
+    INSTALLED_VER="$(nvim --version 2>/dev/null | head -1 | awk '{print $2}')"
+    if [[ "$INSTALLED_VER" == "$NVIM_TARGET_VERSION" ]]; then
+        log "neovim $INSTALLED_VER matches target — skipping"
+        NVIM_TARBALL=""
     else
-        log "neovim already installed: $(nvim --version | head -1)"
+        log "neovim $INSTALLED_VER != target $NVIM_TARGET_VERSION — upgrading"
     fi
-else
-    log "pacstall not installed — falling back to GitHub tarball"
-    ARCH="$(uname -m)"
-    case "$ARCH" in
-        x86_64)        NVIM_TARBALL="nvim-linux64.tar.gz" ;;
-        aarch64|arm64) NVIM_TARBALL="nvim-linux-arm64.tar.gz" ;;
-        *)
-            die "unsupported arch for neovim tarball: $ARCH"
-            ;;
-    esac
+fi
 
-    if command -v nvim >/dev/null 2>&1; then
-        NVIM_VER="$(nvim --version | head -1 | awk '{print $2}' | tr -d 'v')"
-        NVIM_MAJOR="$(echo "$NVIM_VER" | cut -d. -f1)"
-        NVIM_MINOR="$(echo "$NVIM_VER" | cut -d. -f2)"
-        if [[ "${NVIM_MAJOR:-0}" -lt 1 || ("$NVIM_MAJOR" -eq 0 && "${NVIM_MINOR:-0}" -lt 9) ]]; then
-            log "installed neovim $NVIM_VER too old — replacing with latest from GitHub ($ARCH)"
-            sudo apt-get remove -y neovim || true
-        else
-            log "neovim $NVIM_VER from apt is recent enough — keeping it"
-            NVIM_TARBALL=""
-        fi
-    fi
-
-    if [[ -n "$NVIM_TARBALL" ]]; then
-        log "downloading neovim from GitHub ($NVIM_TARBALL)"
-        cd /tmp
-        NVIM_LATEST="$(curl -fsSL https://api.github.com/repos/neovim/neovim/releases/latest | grep tag_name | cut -d'"' -f4)"
-        curl -fL "https://github.com/neovim/neovim/releases/download/${NVIM_LATEST}/${NVIM_TARBALL}" -o nvim.tar.gz
-        sudo rm -rf /opt/nvim-linux* /usr/local/bin/nvim
-        sudo tar -xzf nvim.tar.gz -C /opt/
-        sudo ln -sf "/opt/$(basename nvim.tar.gz .tar.gz)/bin/nvim" /usr/local/bin/nvim
-        rm -f nvim.tar.gz
+if [[ -n "$NVIM_TARBALL" ]]; then
+    log "downloading neovim $NVIM_TARGET_VERSION ($NVIM_TARBALL)"
+    cd /tmp
+    if ! curl -fL --retry 3 \
+        "https://github.com/neovim/neovim/releases/download/${NVIM_TARGET_VERSION}/${NVIM_TARBALL}" \
+        -o nvim.tar.gz; then
+        die "failed to download neovim tarball"
     fi
+    sudo rm -rf /opt/nvim-linux* /usr/local/bin/nvim
+    sudo tar -xzf nvim.tar.gz -C /opt/
+    sudo ln -sf "/opt/$(basename nvim.tar.gz .tar.gz)/bin/nvim" /usr/local/bin/nvim
+    rm -f nvim.tar.gz
 fi
 
 # Verify neovim is reachable (PATH may need /usr/local/bin explicitly for this run)