Drop pacstall, use pinned binary tarball + topgrade update hook

Pacstall tried to BUILD neovim from source (downloaded the v0.12.2
tarball and ran the build chain). On a Pi this is 5+ minutes plus
fragile — pacstall's connection broke during download.

Switch to direct binary tarball install:

1. Pinned to NVIM_TARGET_VERSION='v0.11.4' in two places:
   - run_once_20-install-user-packages.sh.tmpl (initial install)
   - dot_local/bin/update-neovim.sh (topgrade-time updates)

2. Both use the same install logic: detect arch via uname -m, download
   the right tarball (nvim-linux-arm64.tar.gz for aarch64), extract
   to /opt, symlink /usr/local/bin/nvim. Idempotent — if installed
   version == target, no-op.

3. Topgrade config has a [commands] entry that runs the update script
   after system updates. To upgrade neovim across all boxes: edit
   NVIM_TARGET_VERSION in dot_local/bin/update-neovim.sh, commit,
   push, run topgrade.

4. Removed run_once_05-install-pacstall.sh.tmpl entirely — pacstall
   isn't worth the install footprint for one package.

dot_config/topgrade/topgrade.toml

@@ -1,6 +1,6 @@
 # =============================================================================
 #  topgrade.toml — chezmoi-managed
-#  Most steps (system, pacstall, flatpak, snap, cargo, npm, pyenv, rustup, etc.)
+#  Most steps (system, flatpak, snap, cargo, npm, pyenv, rustup, etc.)
 #  are auto-detected by topgrade when their binaries are on $PATH. Only set
 #  custom config here.
 # =============================================================================
@@ -15,3 +15,8 @@ ignore_failures = ["node"]
 
 # Print the time in step titles for verbose output.
 display_time = true
+
+[commands]
+# Bump neovim to the version pinned in update-neovim.sh. Idempotent — no-op
+# if already at target. Edit NVIM_TARGET_VERSION in the script to upgrade.
+"~/.local/bin/update-neovim.sh" = "neovim"

dot_local/bin/update-neovim.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  update-neovim.sh — chezmoi-managed, deployed to ~/.local/bin/update-neovim.sh
+#
+#  Installs or upgrades neovim from the official binary tarball.
+#  Bump NVIM_TARGET_VERSION to upgrade. Topgrade calls this via
+#  ~/.config/topgrade.toml.
+#
+#  Idempotent: no-op if installed version matches target.
+# =============================================================================
+set -euo pipefail
+
+NVIM_TARGET_VERSION="v0.11.4"
+
+ARCH="$(uname -m)"
+case "$ARCH" in
+    x86_64)        NVIM_TARBALL="nvim-linux64.tar.gz" ;;
+    aarch64|arm64) NVIM_TARBALL="nvim-linux-arm64.tar.gz" ;;
+    *)
+        echo "unsupported arch: $ARCH" >&2
+        exit 1
+        ;;
+esac
+
+if command -v nvim >/dev/null 2>&1; then
+    INSTALLED_VER="$(nvim --version 2>/dev/null | head -1 | awk '{print $2}')"
+    if [[ "$INSTALLED_VER" == "$NVIM_TARGET_VERSION" ]]; then
+        echo "neovim $INSTALLED_VER matches target — no action"
+        exit 0
+    fi
+    echo "neovim $INSTALLED_VER -> $NVIM_TARGET_VERSION"
+else
+    echo "installing neovim $NVIM_TARGET_VERSION"
+fi
+
+cd /tmp
+TMP_TARBALL="$(mktemp /tmp/nvim-update.XXXXXX.tar.gz)"
+trap 'rm -f "$TMP_TARBALL"' EXIT
+
+if ! curl -fL --retry 3 \
+    "https://github.com/neovim/neovim/releases/download/${NVIM_TARGET_VERSION}/${NVIM_TARBALL}" \
+    -o "$TMP_TARBALL"; then
+    echo "failed to download $NVIM_TARBALL" >&2
+    exit 1
+fi
+
+sudo rm -rf /opt/nvim-linux* /usr/local/bin/nvim
+sudo tar -xzf "$TMP_TARBALL" -C /opt/
+sudo ln -sf "/opt/$(basename "$TMP_TARBALL" .tar.gz)/bin/nvim" /usr/local/bin/nvim
+
+echo "neovim $NVIM_TARGET_VERSION installed"
+nvim --version | head -1

run_once_05-install-pacstall.sh.tmpl

@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-# =============================================================================
-#  run_once_05-install-pacstall.sh.tmpl  (debian-only)
-#  Install pacstall: AUR-like package manager for debian/ubuntu.
-#  Reference: https://pacstall.dev
-#
-#  Steps:
-#    1. Install pacstall's apt dependencies via apt
-#    2. Run pacstall's official installer (must be root, hence sudo)
-#
-#  Body wrapped in os_family guard: no-op on arch (already has AUR + chaotic).
-# =============================================================================
-set -euo pipefail
-
-log() { printf '\033[1;34m[pacstall]\033[0m %s\n' "$*"; }
-die() { printf '\033[1;31m[pacstall ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
-
-# This script runs as the invoking user; sudo handles elevation.
-
-{{ if eq .os_family "debian" -}}
-# Skip if pacstall is already installed
-if command -v pacstall >/dev/null 2>&1; then
-    log "pacstall already installed: $(pacstall -V 2>/dev/null || echo unknown)"
-    exit 0
-fi
-
-# Update apt cache (installer needs it)
-sudo apt-get update -y
-
-# Make sure we have the tools the pacstall installer needs to fetch and
-# verify its own dependencies. It handles the rest itself.
-log "ensuring pacstall installer prerequisites"
-sudo apt-get install -y --no-install-recommends \
-    curl wget ca-certificates sudo
-
-# Fetch and run pacstall's official installer.
-# It must be invoked as root (sudo). NON_INTERACTIVE=true + </dev/null so it
-# doesn't prompt for the "install axel?" question.
-# The installer installs its own apt dependencies (sudo, wget, build-essential,
-# unzip, git, zstd, iputils-ping, aptitude, bubblewrap, jq, distro-info-data,
-# spdx-licenses, gettext, curl, ca-certificates, optionally axel). For packages
-# not in the host's apt repos (e.g. spdx-licenses on debian trixie), the
-# installer has a built-in fallback that downloads the .deb directly from
-# ftp.debian.org and installs it with apt install.
-log "downloading pacstall installer"
-PACSTALL_INSTALLER="$(mktemp /tmp/pacstall-install.XXXXXX.sh)"
-if ! curl -fL --retry 3 https://pacstall.dev/q/install -o "$PACSTALL_INSTALLER"; then
-    die "failed to download pacstall installer"
-fi
-
-log "running pacstall installer (this installs ~20 scripts to /usr/share/pacstall)"
-sudo NON_INTERACTIVE=true bash "$PACSTALL_INSTALLER" </dev/null
-rm -f "$PACSTALL_INSTALLER"
-
-if ! command -v pacstall >/dev/null 2>&1; then
-    die "pacstall installer ran but pacstall not on PATH"
-fi
-
-log "pacstall installed: $(pacstall -V 2>/dev/null || echo unknown)"
-
-{{ else -}}
-# Not a debian-base box — nothing to do.
-log "skipping pacstall install (os_family={{ .os_family }}, not debian)"
-
-{{ end -}}

run_once_20-install-user-packages.sh.tmpl

@@ -62,18 +62,10 @@ if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
     ln -sf "$(command -v fdfind)" "$USER_HOME/.local/bin/fd"
 fi
 
-# Neovim — install via pacstall on debian (auto-updated by topgrade via
-# built-in pacstall step). Falls back to GitHub tarball if pacstall isn't
-# available for some reason.
-if command -v pacstall >/dev/null 2>&1; then
-    if ! command -v nvim >/dev/null 2>&1; then
-        log "installing neovim via pacstall"
-        sudo pacstall -I neovim
-    else
-        log "neovim already installed: $(nvim --version | head -1)"
-    fi
-else
-    log "pacstall not installed — falling back to GitHub tarball"
+# Neovim — install official binary tarball, pinned to a known-good version.
+# Bump NVIM_TARGET_VERSION to upgrade. ~/.local/bin/update-neovim.sh does
+# the same check + download so topgrade can invoke it for upgrades.
+NVIM_TARGET_VERSION="v0.11.4"
 ARCH="$(uname -m)"
 case "$ARCH" in
     x86_64)        NVIM_TARBALL="nvim-linux64.tar.gz" ;;
@@ -84,29 +76,28 @@ else
 esac
 
 if command -v nvim >/dev/null 2>&1; then
-        NVIM_VER="$(nvim --version | head -1 | awk '{print $2}' | tr -d 'v')"
-        NVIM_MAJOR="$(echo "$NVIM_VER" | cut -d. -f1)"
-        NVIM_MINOR="$(echo "$NVIM_VER" | cut -d. -f2)"
-        if [[ "${NVIM_MAJOR:-0}" -lt 1 || ("$NVIM_MAJOR" -eq 0 && "${NVIM_MINOR:-0}" -lt 9) ]]; then
-            log "installed neovim $NVIM_VER too old — replacing with latest from GitHub ($ARCH)"
-            sudo apt-get remove -y neovim || true
-        else
-            log "neovim $NVIM_VER from apt is recent enough — keeping it"
+    INSTALLED_VER="$(nvim --version 2>/dev/null | head -1 | awk '{print $2}')"
+    if [[ "$INSTALLED_VER" == "$NVIM_TARGET_VERSION" ]]; then
+        log "neovim $INSTALLED_VER matches target — skipping"
         NVIM_TARBALL=""
+    else
+        log "neovim $INSTALLED_VER != target $NVIM_TARGET_VERSION — upgrading"
     fi
 fi
 
 if [[ -n "$NVIM_TARBALL" ]]; then
-        log "downloading neovim from GitHub ($NVIM_TARBALL)"
+    log "downloading neovim $NVIM_TARGET_VERSION ($NVIM_TARBALL)"
     cd /tmp
-        NVIM_LATEST="$(curl -fsSL https://api.github.com/repos/neovim/neovim/releases/latest | grep tag_name | cut -d'"' -f4)"
-        curl -fL "https://github.com/neovim/neovim/releases/download/${NVIM_LATEST}/${NVIM_TARBALL}" -o nvim.tar.gz
+    if ! curl -fL --retry 3 \
+        "https://github.com/neovim/neovim/releases/download/${NVIM_TARGET_VERSION}/${NVIM_TARBALL}" \
+        -o nvim.tar.gz; then
+        die "failed to download neovim tarball"
+    fi
     sudo rm -rf /opt/nvim-linux* /usr/local/bin/nvim
     sudo tar -xzf nvim.tar.gz -C /opt/
     sudo ln -sf "/opt/$(basename nvim.tar.gz .tar.gz)/bin/nvim" /usr/local/bin/nvim
     rm -f nvim.tar.gz
 fi
-fi
 
 # Verify neovim is reachable (PATH may need /usr/local/bin explicitly for this run)
 if ! command -v nvim >/dev/null 2>&1 && [[ -x /usr/local/bin/nvim ]]; then