Fix release CI: stale bread-theme tag path + calamares default-branch clone

- release-iso.yml's "Build bread-theme from source" step grepped
  bos-settings/Cargo.toml for the bread-theme tag pin, but bos-settings was
  split out into its own repo (git.breadway.dev/Breadway/bos-settings) --
  that path no longer exists in this checkout, so the grep would fail (or
  silently find nothing). Now fetches bos-settings' Cargo.toml directly from
  its own repo (dev branch, the one its own CI actually publishes the
  bos-settings pacman package from) via the Forgejo raw-file endpoint.

- calamares.yml cloned the repo's default branch instead of the branch/tag
  that actually triggered the run -- bibata.yml, powerlevel10k.yml, and
  yay-bin.yml (the other in-house-PKGBUILD workflows in this same family)
  all correctly clone --branch "${GITHUB_REF_NAME}". Brought calamares.yml
  in line with them.

- breadhelp-tour.lua interpolated an untrusted, client-controlled Wayland
  window class / layer-shell namespace directly into a bread.exec shell
  command string -- a session-level shell injection vector (verified
  exploitable with a crafted window class before this fix, e.g.
  "evil; touch ~/pwned #"). bread.exec only accepts a single shell string
  (always run via `sh -lc`, per breadd/src/lua/mod.rs) -- there's no
  array-exec form to bypass the shell with -- so the fix is a proper POSIX
  shell_quote() helper wrapping every interpolated value in single quotes
  before it reaches bread.exec.

.forgejo/workflows/release-iso.yml

@@ -111,8 +111,18 @@ jobs:
         run: |
           set -euo pipefail
           # bread-theme is not in the bakery index; build it at the tag pinned
-          # in bos-settings/Cargo.toml so the CLI matches the library version.
-          THEME_TAG=$(grep 'bread-theme.*tag' /bos/bos-settings/Cargo.toml \
+          # in bos-settings' Cargo.toml so the CLI matches the library version
+          # the bos-settings package (and breadbar/breadbox/breadpad) were
+          # built against. bos-settings used to live at bos-settings/Cargo.toml
+          # inside this repo; it's since been split into its own repo
+          # (git.breadway.dev/Breadway/bos-settings), so fetch its Cargo.toml
+          # from there instead of a path that no longer exists in this
+          # checkout. Uses bos-settings' default branch (dev) — the branch its
+          # own CI actually publishes the `bos-settings` pacman package from.
+          REPO_OWNER="${GITHUB_REPOSITORY%%/*}"
+          curl -fsSL "https://git.breadway.dev/${REPO_OWNER}/bos-settings/raw/branch/dev/Cargo.toml" \
+            -o /tmp/bos-settings-Cargo.toml
+          THEME_TAG=$(grep 'bread-theme.*tag' /tmp/bos-settings-Cargo.toml \
                       | grep -oP '"v[^"]+"' | tr -d '"')
           echo "Building bread-theme @ $THEME_TAG"
           git clone --branch "$THEME_TAG" --depth 1 \