Find the caller of the Bash startup check the way /proc numbers it

The check read /proc/$$/cmdline. arch-chroot runs its command in a new PID
namespace beneath the outer /proc, where $$ names no process or someone
else's, so every bash -p entrypoint was rejected there with status 126.

The installer met this as soon as one was called at install time:
install/config/thunderbolt-authorization.sh runs
omarchy-thunderbolt-authorization-admin, and the edge ISO stopped in
"Configuring system" with "/proc/219/cmdline: No such file or directory".

The check runs in a child of the caller, so read the parent from that
child's /proc/self/stat, which is given in the numbering of the /proc it is
read through. Outside a PID namespace that is $$, as before.

bin/omarchy-security-functions

@@ -10,13 +10,18 @@ fi
 
 omarchy_security_require_privileged_bash_startup() {
   [[ $- == *p* ]] || return 1
+  # The caller is this check's parent, under the number this /proc gives it.
+  # arch-chroot runs the installer in a new PID namespace beneath the outer
+  # /proc, where $$ names no process, or someone else's.
   /usr/bin/env -i /usr/bin/bash -p -c '
-    mapfile -d "" -t argv <"/proc/$1/cmdline" || exit 1
-    executable=$(/usr/bin/readlink -e -- "/proc/$1/exe") || exit 1
+    stat=$(</proc/self/stat) || exit 1
+    read -r _ caller _ <<<"${stat##*) }"
+    mapfile -d "" -t argv <"/proc/$caller/cmdline" || exit 1
+    executable=$(/usr/bin/readlink -e -- "/proc/$caller/exe") || exit 1
     [[ $executable == "/usr/bin/bash" &&
       ( ${argv[0]:-} == "/bin/bash" || ${argv[0]:-} == "/usr/bin/bash" ) &&
       ${argv[1]:-} == "-p" ]]
-  ' omarchy-bash-startup "$$"
+  ' omarchy-bash-startup
 }
 
 omarchy_security_sanitize_bash_environment() {