Move bat cargo install from run_once_20 to run_onchange_30

run_once_20 runs BEFORE run_onchange_30 in the bootstrap chain, so
'command -v cargo' inside run_once_20 was always false on a fresh
box — cargo install bat was skipped, leaving bat missing on debian.

Move the bat install to run_onchange_30 (which runs last, after
rustup is installed). Restructure the script to:
1. Ensure cargo is installed (existing logic)
2. Install bat via cargo on debian only (new logic, gated by os_family)

This way the bootstrap chain becomes:
  run_once_00 -> run_once_10 -> run_once_20 (apt packages, neovim, oh-my-zsh, font)
  -> run_onchange_30 (rustup, then bat from crates.io)

Crouton currently has rustup installed but no bat (cargo install
in progress in background). Re-running chezmoi init will skip
run_once_20 (state recorded) and re-run run_onchange_30 (content
changed), which will see bat missing and trigger cargo install
automatically.

run_once_20-install-user-packages.sh.tmpl

@@ -64,13 +64,8 @@ if command -v fdfind >/dev/null 2>&1 && ! command -v fd >/dev/null 2>&1; then
 fi
 
 # Debian ships 'bat' as 'batcat' due to a name clash with an unrelated
-# package. Install upstream 'bat' via cargo so we get the real binary at
+# package. The install happens in run_onchange_30 (after rustup is ready,
-# $HOME/.cargo/bin/bat. Faster than apt's renamed package, version-aligned
+# via `cargo install bat`).
-# with arch's pacman install.
-if command -v cargo >/dev/null 2>&1 && ! command -v bat >/dev/null 2>&1; then
-    log "installing bat via cargo (upstream, debian renames it to batcat)"
-    cargo install bat --locked 2>&1 | tail -5
-fi
 
 # Neovim — install official binary tarball, pinned to a known-good version.
 # Bump NVIM_TARGET_VERSION to upgrade. ~/.local/bin/update-neovim.sh does

run_onchange_30-ensure-cargo.sh.tmpl

@@ -2,6 +2,9 @@
 # =============================================================================
 #  run_onchange_30-ensure-cargo.sh.tmpl
 #  Make sure rustup/cargo is available. If not, install rustup.
+#  After cargo is ready, install bat from crates.io on debian (apt renames
+#  upstream bat to batcat, which breaks .zshrc's `alias cat=bat`).
+#
 #  Runs on every apply because the script body rarely changes but we want a
 #  fresh check after package installs.
 # =============================================================================
@@ -9,21 +12,35 @@ set -euo pipefail
 
 log() { printf '\033[1;34m[cargo]\033[0m %s\n' "$*"; }
 
-if command -v cargo >/dev/null 2>&1; then
+# --- 1. Ensure cargo is on PATH ---
-    log "cargo already installed: $(cargo --version)"
+if ! command -v cargo >/dev/null 2>&1; then
-    exit 0
+    if command -v rustup >/dev/null 2>&1; then
-fi
-
-if command -v rustup >/dev/null 2>&1; then
         log "rustup present but cargo missing — running rustup default"
         rustup default stable
-    exit 0
+    else
+        log "no cargo or rustup — installing rustup"
+        sh -c "$(curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs)" -- -y --default-toolchain stable --profile minimal
+        # shellcheck disable=SC1091
+        source "$HOME/.cargo/env"
+    fi
 fi
 
-log "no cargo or rustup — installing rustup"
+# Ensure subsequent commands in this script can find cargo
-sh -c "$(curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs)" -- -y --default-toolchain stable --profile minimal
+export PATH="$HOME/.cargo/bin:$PATH"
-# shellcheck disable=SC1091
-source "$HOME/.cargo/env"
 
-log "rustup installed: $(rustup --version)"
+log "rustup installed: $(rustup --version 2>/dev/null || echo unknown)"
 log "cargo installed: $(cargo --version)"
+
+# --- 2. Install bat from crates.io if missing (debian only) ---
+{{ if eq .os_family "debian" -}}
+if ! command -v bat >/dev/null 2>&1; then
+    log "installing bat via cargo (upstream, debian renames it to batcat)"
+    cargo install bat --locked
+    log "bat installed: $(bat --version)"
+else
+    log "bat already installed: $(bat --version)"
+fi
+{{ else -}}
+# Arch already installs upstream bat via pacman; nothing extra to do.
+log "skipping cargo bat install (os_family={{ .os_family }}, pacman handles it)"
+{{ end -}}