fix(installer): resolve owner in one chroot call, log ydotool link errors

Two low-severity review findings on 8501a60:

- owner="$(id -u):$(id -g)" as two substitutions only propagates the
  last status, so a lone id -u failure would build ':1000' and abort at
  the chown with "invalid owner" under the wrong line. Run both ids in
  a single arch-chroot sh -c chained with && and join with paste -sd:;
  pipefail makes any failure abort at the owner= line. Verified both
  paths: existing user yields 1000:1000, missing user trips the ERR
  trap before owner is used.
- the ydotool symlink mkdir/ln wrote stderr to the terminal while the
  failure warn pointed at $LOG, which never recorded it; redirect both
  into the log, matching the bluetooth block.

airootfs/usr/local/bin/alvin-install

@@ -543,8 +543,11 @@ install_end4_dots() {
     # $USERNAME — the user exists only inside $TARGET — so name lookup fails
     # ("chown: invalid user"). Resolve the numeric ids from the target and
     # chown by number; the catch-all at the end of this function does the same.
+    # One arch-chroot call chained with && : a plain "a=$(id -u):$(id -g)"
+    # would only propagate the last substitution's status, so a lone id -u
+    # failure would silently produce ':1000' and abort at the wrong line.
     local owner
-    owner="$(arch-chroot "$TARGET" id -u "$USERNAME"):$(arch-chroot "$TARGET" id -g "$USERNAME")"
+    owner=$(arch-chroot "$TARGET" sh -c "id -u '$USERNAME' && id -g '$USERNAME'" | paste -sd:)
 
     cp -a /opt/dots-hyprland "$repo_on_host"
     chown -R "$owner" "$repo_on_host"
@@ -610,8 +613,10 @@ install_end4_dots() {
     # `enable` would write — the same absolute link systemctl produces.
     if [[ -f "${TARGET}/usr/lib/systemd/user/ydotool.service" ]]; then
         local yd_wants="${TARGET}${home_in_target}/.config/systemd/user/default.target.wants"
-        if mkdir -p "$yd_wants" \
-            && ln -sfn /usr/lib/systemd/user/ydotool.service "$yd_wants/ydotool.service"; then
+        # stderr goes to $LOG so the failure warn below points at something
+        # that actually records it (as the bluetooth block does).
+        if { mkdir -p "$yd_wants" \
+            && ln -sfn /usr/lib/systemd/user/ydotool.service "$yd_wants/ydotool.service"; } 2>>"$LOG"; then
             log "ydotool.service enabled for ${USERNAME} (symlinked in user unit dir)."
         else
             warn "Could not enable ydotool.service for ${USERNAME} (see $LOG)."