fix(install): make setup failures explicit and atomic

Installer pipelines masked dependency and download failures, causing
false success messages and unsafe config replacement.

Atomic updates and current upstream installers keep failures visible.

patch.sh

@@ -1,16 +1,30 @@
 #!/bin/bash
 
+set -euo pipefail
+
 BASE_URL="https://git.miomio.moe/mio/easyzsh/raw/branch/master/zshrc"
 
 ZSH_CONFIGS_DIR="$HOME/.config/zshrc"
-mkdir -p $ZSH_CONFIGS_DIR
+mkdir -p "$ZSH_CONFIGS_DIR"
 
 if [ "$#" -gt 0 ]; then
     for arg in "$@"; do
-        if ! wget "${BASE_URL}/${arg}.zsh" -O "${ZSH_CONFIGS_DIR}/${arg}.zsh"; then
+        if [[ -z "$arg" || "$arg" == *[![:alnum:]_-]* ]]; then
+            echo "Invalid config name: $arg" >&2
+            exit 1
+        fi
+
+        destination="${ZSH_CONFIGS_DIR}/${arg}.zsh"
+        temporary=$(mktemp "$HOME/.config/.easyzsh-${arg}.XXXXXX")
+        trap 'rm -f "$temporary"' EXIT
+
+        if ! curl -fsSL "${BASE_URL}/${arg}.zsh" -o "$temporary"; then
             echo "Failed to download ${arg}.zsh from ${BASE_URL}"
             exit 1
         fi
+
+        mv "$temporary" "$destination"
+        trap - EXIT
     done
 else
     echo "No arguments provided. Please specify the config files to download."