Fix bumblebee install path, ship the missing scan script and timer

[Percius04]

Fixes #1.

bumblebee install path

bbInstallProc targeted the module root:

go install github.com/perplexityai/bumblebee@latest

which fails:

go: github.com/perplexityai/bumblebee@latest: module github.com/perplexityai/bumblebee@latest found (v0.1.2), but does not contain package github.com/perplexityai/bumblebee

The installable binary is at cmd/bumblebee. Fixed the target path — verified it installs and runs correctly.

Missing qs-security-scan.sh + timer

The README documents ~/.local/bin/qs-security-scan.sh and a systemd timer as what feeds ~/.cache/qs-security-status.json (what statusFile reads), but neither is actually in the repo — so even a correctly installed scanner never produces a visible result, because nothing ever writes the status file.

Added:

• qs-security-scan.sh — skips the AUR-Malware section cleanly when it isn't installed (checks executability at QS_SEC_AUR_MALWARE first), runs bumblebee scan when installed and summarizes package/finding counts into the JSON shape SecurityWidget.qml expects.
• systemd/qs-security-scan.{service,timer} — the units the README already describes inline, as actual files.
• Wired an opt-in step into install.sh (mirroring the existing bun-check prompt) that copies the script, installs the units, and enables the timer.

AUR-Malware install (added in a follow-up commit)

The install button cloned Atomic-Arch/AUR-Malware, which no longer exists (404) — always failed, surfaced as a generic "maybe git isn't in PATH" error. The fallback path, /local/applications/AUR-Malware, also isn't writable without root.

This repo's own GitHub "About" section already links nightdevil00/AUR-Malware as the intended source — it just was never wired into the README or the install button, which still pointed at the dead repo. Repointed both, plus the default path, to it (a maintained fork shipping the same check-atomic-arch_new.sh), using ~/.local/share/AUR-Malware instead of the root-owned path.

Also fixed qs-security-scan.sh's AUR-Malware branch: the script's exit code is always 0 regardless of findings, and grabbing the last output line as a summary was picking up a disclaimer fragment instead of a verdict — switched to --json and parse the trailing JSON object (verdict + pass/warn/fail counts) directly.

Tested end-to-end on a real machine: bumblebee installs, AUR-Malware installs and scans, qs-security-scan.timer runs on schedule, and the widget shows real results for both scanners instead of "never scanned".