terminal-helper: Honor $TERMINAL and harden terminal launching

[lenitain]

Summary

terminal-helper documented $TERMINAL as the first-priority terminal (see the invariants comment), but never actually read it. The script always fell back to the hardcoded term_order list, so users' preferred terminal was ignored.

Honoring $TERMINAL makes every entry in the terminals map reachable, which exposed several latent issues in those previously untested code paths. This PR fixes them all.

Changes

• Honor $TERMINAL — checked first, but only when the value is a known terminal from the terminals map (guarantees the correct invocation syntax) and the binary exists. Invalid/stale values fall back to term_order as before.
• ptyxis: ptyxis -e … → ptyxis -- … — ptyxis has no -e option; -- PROGRAM is the documented form and implies standalone mode (no detached client).
• kitty: added --wait-for-single-instance-window-close — previously, with a running kitty instance, the client rocess exited immediately and the temp script could be deleted before the new window read it.
• Launch fallback chain — candidates are tried in order ($TERMINAL first, then installed terminals in term_order). If a launch fails, the next candidate is tried; retrying stops on exit codes 126/127 (e.g. the user dismissed the pkexec prompt), and if no terminal launches at all a desktop notification is shown and the script exits 2.
• Exit-code normalization — exit 0 is appended to the temp script. Terminals like foot and st propagate the child's exit status, which must not be mistaken for a launch failure (previously this would have re-run the command in the next terminal).
• kgx — the kill command is now also appended when $TERMINAL=kgx, guarded against $PPID == 1, and exit status 131 (killed by SIGQUIT after completion) is treated as a successful launch instead of a failure.
• Robustness — explicit aborts on mktemp/write failures (replacing the removed set -e), and the temp file is cleaned up on every path, including the "no terminal installed" path that previously leaked it.

Notes

• With escalate=true, real pkexec forks, so kgx's kill line targets the pkexec wrapper rather than the terminal — the window may stay open after the command finishes. Cosmetic only; the command itself has already completed.