Add pacstall for neovim install + version updates on debian

Three changes:

1. NEW run_once_05-install-pacstall.sh.tmpl (debian-only)
   Installs pacstall via its official installer. Pacstall is an
   AUR-like package manager for debian/ubuntu, with neovim at
   0.12.2-1 (current as of bootstrap). The installer requires
   root and prompts for 'install axel?', so we run it under
   sudo with NON_INTERACTIVE=true and stdin redirected from /dev/null.

2. UPDATE run_once_20-install-user-packages.sh.tmpl
   On debian, prefer pacstall over the GitHub tarball when
   pacstall is available. The tarball fallback remains for the
   case where pacstall install failed or isn't wanted.

3. NEW dot_config/topgrade/topgrade.toml
   Topgrade's built-in pacstall step auto-detects pacstall and
   runs 'pacstall -U -Up' (update repo + upgrade packages).
   Built-in chezmoi step also auto-detects chezmoi. So our
   topgrade config just sets pre_sudo=true for password caching
   and ignore_failures for node.

dot_config/topgrade/topgrade.toml

@@ -0,0 +1,17 @@
+# =============================================================================
+#  topgrade.toml — chezmoi-managed
+#  Most steps (system, pacstall, flatpak, snap, cargo, npm, pyenv, rustup, etc.)
+#  are auto-detected by topgrade when their binaries are on $PATH. Only set
+#  custom config here.
+# =============================================================================
+
+[misc]
+# Run `sudo -v` at the start so cached credentials cover the whole run.
+# Without this, topgrade will pause for password mid-run on each sudo invocation.
+pre_sudo = true
+
+# Don't fail the whole run if one step fails.
+ignore_failures = ["node"]
+
+# Print the time in step titles for verbose output.
+display_time = true

run_once_05-install-pacstall.sh.tmpl

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# =============================================================================
+#  run_once_05-install-pacstall.sh.tmpl  (debian-only)
+#  Install pacstall: AUR-like package manager for debian/ubuntu.
+#  Reference: https://pacstall.dev
+#
+#  Steps:
+#    1. Install pacstall's apt dependencies via apt
+#    2. Run pacstall's official installer (must be root, hence sudo)
+#
+#  Body wrapped in os_family guard: no-op on arch (already has AUR + chaotic).
+# =============================================================================
+set -euo pipefail
+
+log() { printf '\033[1;34m[pacstall]\033[0m %s\n' "$*"; }
+die() { printf '\033[1;31m[pacstall ERROR]\033[0m %s\n' "$*" >&2; exit 1; }
+
+# This script runs as the invoking user; sudo handles elevation.
+
+{{ if eq .os_family "debian" -}}
+# Skip if pacstall is already installed
+if command -v pacstall >/dev/null 2>&1; then
+    log "pacstall already installed: $(pacstall -V 2>/dev/null || echo unknown)"
+    exit 0
+fi
+
+# Install pacstall's apt deps first (idempotent — pacstall will skip if present)
+log "installing pacstall apt dependencies"
+sudo apt-get update -y
+sudo apt-get install -y --no-install-recommends \
+    sudo wget build-essential unzip git zstd iputils-ping \
+    aptitude bubblewrap jq distro-info-data spdx-licenses \
+    gettext curl ca-certificates
+
+# Fetch and run pacstall's official installer.
+# It must be invoked as root (sudo). NON_INTERACTIVE=true + </dev/null so it
+# doesn't prompt for the "install axel?" question.
+log "downloading pacstall installer"
+PACSTALL_INSTALLER="$(mktemp /tmp/pacstall-install.XXXXXX.sh)"
+if ! curl -fL --retry 3 https://pacstall.dev/q/install -o "$PACSTALL_INSTALLER"; then
+    die "failed to download pacstall installer"
+fi
+
+log "running pacstall installer (this installs ~20 scripts to /usr/share/pacstall)"
+sudo NON_INTERACTIVE=true bash "$PACSTALL_INSTALLER" </dev/null
+rm -f "$PACSTALL_INSTALLER"
+
+if ! command -v pacstall >/dev/null 2>&1; then
+    die "pacstall installer ran but pacstall not on PATH"
+fi
+
+log "pacstall installed: $(pacstall -V 2>/dev/null || echo unknown)"
+
+{{ else -}}
+# Not a debian-base box — nothing to do.
+log "skipping pacstall install (os_family={{ .os_family }}, not debian)"
+
+{{ end -}}

run_once_20-install-user-packages.sh.tmpl

@@ -62,9 +62,18 @@ if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
     ln -sf "$(command -v fdfind)" "$USER_HOME/.local/bin/fd"
 fi
 
-# Neovim — always install the latest official binary tarball on debian.
-# apt's neovim is too old for LazyVim on stable (bookworm), and even on
-# trixie we want a known-good version. Detect arch for the right tarball.
+# Neovim — install via pacstall on debian (auto-updated by topgrade via
+# built-in pacstall step). Falls back to GitHub tarball if pacstall isn't
+# available for some reason.
+if command -v pacstall >/dev/null 2>&1; then
+    if ! command -v nvim >/dev/null 2>&1; then
+        log "installing neovim via pacstall"
+        sudo pacstall -I neovim
+    else
+        log "neovim already installed: $(nvim --version | head -1)"
+    fi
+else
+    log "pacstall not installed — falling back to GitHub tarball"
     ARCH="$(uname -m)"
     case "$ARCH" in
         x86_64)        NVIM_TARBALL="nvim-linux64.tar.gz" ;;
@@ -94,10 +103,10 @@ if [[ -n "$NVIM_TARBALL" ]]; then
         curl -fL "https://github.com/neovim/neovim/releases/download/${NVIM_LATEST}/${NVIM_TARBALL}" -o nvim.tar.gz
         sudo rm -rf /opt/nvim-linux* /usr/local/bin/nvim
         sudo tar -xzf nvim.tar.gz -C /opt/
-    # The arm64 tarball extracts to nvim-linux-arm64, x86_64 to nvim-linux64.
         sudo ln -sf "/opt/$(basename nvim.tar.gz .tar.gz)/bin/nvim" /usr/local/bin/nvim
         rm -f nvim.tar.gz
     fi
+fi
 
 # Verify neovim is reachable (PATH may need /usr/local/bin explicitly for this run)
 if ! command -v nvim >/dev/null 2>&1 && [[ -x /usr/local/bin/nvim ]]; then