security: always restore sudoers after makepkg, drop dead paru block

The archlinux and zfs roles temporarily write `%wheel ALL=(ALL) NOPASSWD: ALL`
to /etc/sudoers so makepkg/paru can run unattended, then restore it in a
following task. Since the restore was a plain sibling task, any failure in
between aborted the play and left the host with passwordless root for the
whole wheel group. Move the restore into `always:` so it runs on failure too,
and narrow the window in yay.yml to just the makepkg call (dependency install,
directory setup and git clone no longer run inside it).

This is not hypothetical: a provisioning run of omega failed on paru's git
clone and left the sudoers hack in place.

The clone failed because the deprecated compile-from-source paru block, which
was commented out in tree, had been re-enabled. It fed paru_git_repo into the
git module, but that variable now holds a GitHub owner/repo slug for the
releases API rather than a clone URL. Remove the block outright, along with
the orphaned paru_src_path default; paru is installed from the release binary.

Also fix the ansible-lint violations this surfaced so roles/archlinux passes
the production profile: explicit `become` next to `become_user`, a pinned
branch on the yay clone, and `changed_when` on the command/shell tasks.

roles/archlinux/tasks/yay.yml

@@ -14,14 +14,6 @@
           - git
         state: present
 
-    - name: Disable sudo password prompt (makepkg sudoers hack)
-      ansible.builtin.lineinfile:
-        dest: /etc/sudoers
-        state: present
-        regexp: "^#?%wheel"
-        line: "%wheel ALL=(ALL) NOPASSWD: ALL"
-        validate: /usr/sbin/visudo -cf %s
-
     - name: Clean up stale yay sources dir
       ansible.builtin.file:
         path: "{{ yay_src_path }}"
@@ -35,22 +27,40 @@
         mode: "0755"
 
     - name: Clone git sources
+      become: true
       become_user: "{{ ansible_user }}"
       ansible.builtin.git:
         repo: "{{ yay_git_repo }}"
         dest: "{{ yay_src_path }}"
+        version: master
 
-    # note: this only works because SUDOERS password prompt is disabled
-    - name: Build and install
-      become_user: "{{ ansible_user }}"
-      ansible.builtin.command:
-        chdir: "{{ yay_src_path }}"
-        cmd: "makepkg -si -f --noconfirm"
+    # makepkg refuses to run as root and shells out to sudo to install the
+    # built package, so `--noconfirm` needs a passwordless sudo window.
+    # Keep that window as small as possible and always close it: the restore
+    # lives in `always` so it runs even when the build fails, which otherwise
+    # leaves the host with passwordless root for the whole wheel group.
+    - name: Build and install yay
+      block:
+        - name: Disable sudo password prompt (makepkg sudoers hack)
+          ansible.builtin.lineinfile:
+            dest: /etc/sudoers
+            state: present
+            regexp: "^#?%wheel"
+            line: "%wheel ALL=(ALL) NOPASSWD: ALL"
+            validate: /usr/sbin/visudo -cf %s
 
-    - name: Restore sudo with password prompt
-      ansible.builtin.lineinfile:
-        dest: /etc/sudoers
-        state: present
-        regexp: "^#?%wheel"
-        line: "%wheel ALL=(ALL:ALL) ALL"
-        validate: /usr/sbin/visudo -cf %s
+        - name: Build and install
+          become: true
+          become_user: "{{ ansible_user }}"
+          ansible.builtin.command:
+            chdir: "{{ yay_src_path }}"
+            cmd: "makepkg -si -f --noconfirm"
+          changed_when: true
+      always:
+        - name: Restore sudo with password prompt
+          ansible.builtin.lineinfile:
+            dest: /etc/sudoers
+            state: present
+            regexp: "^#?%wheel"
+            line: "%wheel ALL=(ALL:ALL) ALL"
+            validate: /usr/sbin/visudo -cf %s