fix(fastfetch): harden the status cache and sign the terminal args script

[DevSecNinja]

Follow-ups on #654 from a rubber-duck review, plus the .ps1.tmpl signing question you raised.

1. The terminal-args script is now a plain, signable .ps1

You were right to question the .tmpl. sign-powershell.yml signs **.ps1 but explicitly excludes **.ps1.tmpl (a rendered template no longer matches its signature), so as merged that script could never be signed.

Neither template input turned out to be load-bearing:

• The {{ if eq .chezmoi.os "windows" }} guard is redundant — .chezmoiignore already drops .chezmoiscripts/windows/** on non-Windows, and the plain signed scripts already in that folder (run_once_setup-windows-terminal.ps1, run_once_install-wsl.ps1, …) carry no such guard.
• {{ .chezmoi.sourceDir }} is replaceable with $env:CHEZMOI_SOURCE_DIR, which I confirmed chezmoi exports to every script it runs:

  CHEZMOI_SOURCE_DIR=[C:/Users/JEANPA~1/AppData/Local/Temp/cz-src-test]
  CHEZMOI=[1]

  Note it arrives with forward slashes and sometimes in 8.3 form, so the path is composed with Join-Path rather than concatenated, and falls back to the applied tree (~/.config/powershell/modules/DotfilesHelpers) when the script is run by hand.

I also verified signing survives execution: chezmoi copies the script to a temp file before running it ($PSCommandPath = …\Temp\2548640419.probe.ps1), and Authenticode status is unchanged by a copy to a different path/name.

The sibling templates deliberately keep their .tmpl — set-windows-terminal-copilot-profile.ps1.tmpl genuinely embeds .copilotSshHost. The default-profile and font ones could be converted in a focused follow-up if you want; I left them alone rather than churn unrelated files here.

2. Two cache bugs, both only visible with two shells starting at once

• Orphan cleanup was too broad. It deleted every non-.src file lacking a matching source — including another writer's in-flight <name>.tmp, which would then break that process's Move-Item. It now skips .tmp files.
• Both writers used a fixed <name>.tmp. Two shells rendering the same section raced for one path. Temp names are now unique (GetRandomFileName) and cleaned up in a finally.

3. fastfetch exiting ≠ fastfetch succeeding

WaitForExit() returning true only means the process ended. A non-zero exit (a bad config, say) paints nothing, but still suppressed the welcome lines — so a broken fastfetch looked like a hung shell. Now only ExitCode -eq 0 counts as a rendered banner.

Testing

• Pester: 773 passed, 4 failed — the same pre-existing signing-cert tests that fail on main.
• bats 20/20; shellcheck + shfmt clean; PSScriptAnalyzer clean; chezmoi apply --dry-run clean.
• New regression tests cover all three fixes: in-flight .tmp survival, unique temp names, and the non-zero-exit case.
• The converted script was executed exactly the way chezmoi invokes it (pwsh -NoLogo -NoProfile -File … with CHEZMOI_SOURCE_DIR set) — it applied pwsh.exe -NoLogo -NoProfileLoadTime to the real Windows Terminal profile and is idempotent on re-run.

Rebased onto current main (post-#654 and its signing commit); the stale signature blocks on the three edited files are left in place for the workflow to replace, per the repo convention.