Fix correctness bugs across the helper scripts

panama-osd read the wrong brightnessctl field, showing the hardware
max instead of a percentage on any backlight device. panama-doctor
called three sibling scripts by bare name with nothing on PATH,
making three health checks permanently and falsely report broken; its
repair actions also reused the short probe timeout, so a slow-but-
successful restart was reported as failed. panama-wifi-qr left the
cleartext passphrase temp file behind on its failure path (the RETURN
trap doesn't fire on exit), and its nmcli parsing broke on connection
names containing a colon or backslash -- verified against a real
NetworkManager profile.

panama-power-profile's set command always returned success regardless
of whether the write actually took. panama-keyring's daemon-origin
check picked whichever gnome-keyring-daemon process happened to
enumerate first in /proc, defeating the exact dual-daemon scenario it
exists to detect; it now resolves the PID that actually owns the
Secret Service D-Bus name. gnf aborted before running a firmware
update whenever the metadata was already current (a non-error exit
under set -e), and its flatpak update lacked the -y its own docs
promise.

Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ

config/dot/quickshell/scripts/panama-power-profile

@@ -67,15 +67,19 @@ cmd_list() {
 }
 
 cmd_set() {
-    local profile="${1:-}"
+    local profile="${1:-}" status
     # Constrained rather than passed through: this reaches a system service.
     [[ "$profile" =~ ^[a-z-]+$ ]] || {
         printf 'panama-power-profile: refusing a profile name with unexpected characters\n' >&2
         return 2
     }
+    # pipefail is set above, so $? here is busctl's real exit status, not
+    # head's -- a failed write (daemon stopped, profile rejected) must be
+    # reported rather than always claimed as a success.
     busctl set-property "$BUS_NAME" "$OBJECT" "$BUS_NAME" ActiveProfile s "$profile" 2>&1 >/dev/null \
         | head -2 >&2
-    return 0
+    status=$?
+    return "$status"
 }
 
 case "${1:-list}" in