age: add nibble recipient, rekey secrets

dot_omp/private_agent/encrypted_private_zai.key.age

@@ -1,23 +1,25 @@
 age-encryption.org/v1
--> X25519 iDHtjHMwOu626HRKO0CraLpeXPSEUCt0t49UygPfhhU
+-> X25519 9yf39g3iKVkclHtuOeYRR71QYWcgzW2l2QGZlrO8UW4
-tAt+1DMoZqqtoTfLdBbXHVccEadqleaq+wtTXir+/2c
+fRiXdXYf/nbK322TiajZPDFuFTsartK9NvreyJrjLiM
--> X25519 fi13vlKB5TevI+Sn1u8rDhQHZRZuFNkYJX6rVZUKDEE
+-> X25519 A9YH93Z6U7blsEic1VARrwTopxSlNUAkrpxRilIAgDI
-VzNz/3F7KH+OI4y+mZFfsiIIkAlVwPJI5Z27lPjtIrk
+i/sWzDH9FVMYZmDmlnDp4PJVQjChrJCkEmEgccT9h18
--> X25519 yIIxKlUjiUqDOP0cdkDwahqHnMuBxTmJQe4zkIQ8XjI
+-> X25519 uqFTiyY4u43pyVGFL37jG3LLKb+jIh0j+ecbUTpLJRs
-vhLJRwTf7C6UraGS2aOe2Y6SBA5m283Llk0BuhWD8FQ
+9SE6XhTan4AeegBgswhlgmq5iSzF4A1dsQHVcLaSudE
--> X25519 MxemHIDKBj/qofdhZfaFZ+qlxlrJSFO6Xa+pAicsuxQ
+-> X25519 dwuwL5rnBVJnXIyeakoXg5j8CYh+qPh4wDnTIe6MnQc
-zuPPl87pw2Pazqv/x3rF34dz6nTqYAIbguuyHRJBURo
+iIC66EhAXdwwdic6TUmZNbqp/qi54khfE5YuioDY1Lg
--> X25519 taJEGeyDxDYJkIeRIHh0pSvSSe6KEDHCURYwjIHu+xA
+-> X25519 w5dYpBw+jsbg7UZYmgW0O6gJ16Uw/c49gAvdoBlNlxM
-PB5CZIM20AmWVPh72R6qRcGLnacZsPf5QZg39cpmy5I
+fJFBZvGYquarlUITnPwvhKuG+YciVSoqGTA6OD6aewc
--> X25519 WUmpiFOVgtQm/5Khfg4CS9rcCuuol0Olm597jsAIMF8
+-> X25519 /Yx7fea5Agfs2hs9LZ8wZf3HUX4H/fEWg3gAldj2QU0
-V+jIBtMM6rKAnzdK6/idlxYz+Sc5AGIuiJRNCDUWL6A
+7Rni9hSbZlG8w6E7jbGsd3i1mjIzQCN2c3WFogO84y4
--> X25519 nW4GllyBIP1APZZEkveHLly6HLdrRC1m4+XTu7r31FE
+-> X25519 e/2+6VSGM1Jd89J7DPvDnn6qJ+MWRumGbu7gLc0FXi4
-yZd6ECENvmLPPzIaw570kItQeBaO4V2GvbNRQBq9BGs
+PqEcUj+7EbvN17KfgnGeIVPepz/sGGGiLQGB4XvgroM
--> X25519 +ErrPvmkwyQNZnQc9uWZPSByYlOP0lUONoF35sTK1FQ
+-> X25519 KagAig5HgY45ighwkIqMALjEC9g24q2PUK79AbfTMjI
-FQdc/1DSkjIx2ivUeNM0oWqyUpsalb1ekTji8kof7kc
++SwKy91JPWI4LaiREJebLDlcynAKe/7dtf1SdbQDzCo
--> X25519 SCLUse0ETYtXftkk5K7UhvJ8yZJXOa5hrOfMJliSZSY
+-> X25519 iJmp0xrkA3b+m4dwx3Zl+vPopwQAEgMPi3kZ0dNf314
-/ZfeUbGK+BVU0D0MgjTccEXHhEpidupPMr+QfZgy43A
+aVaGSKO/UFGSqBDueOFUdL5UmpbDFJjnmdgQtd5t4go
--> X25519 6aloO0UDHK2cZl5Xu1PQFea2uZe74x42RxBiZSEshx4
+-> X25519 q+mRCef2xnvbA7ONSZJ7cXqLecVSA16f/gr1o165lSQ
-UYqvdyuvZdh6xvl0+m7RmCBNQRV8q7mhW2AkS9SEkuM
+nJ64HwtEgpe2EgMfI39/bV90NT013Dzcn8dIIy6f7k8
---- MkLqtCIC9j9neAl5freGDKLAFV4eDd4x52GnmVyzEI4
+-> X25519 CdtKlNDdzFhs9fChbC9s0O6NielqiiqTVnrF3EJqkyc
-‘Š4˜ùô{¿o‹Ú	m<>œóÞjõÀ`ý¼Ϥ‚ÐÐÍ_'âÔ£ŸÝ<C5B8>¤º*9oG<6F>òšsÂ5<C382>™Y:ü"EºËx §Zåø÷Z/‰rÓL
+XUOC8T/oQieWdI7QbRex/SRSZGxT2Rbl0XqtkUYgPO8
+--- bhnHAJr+D94bZJ8nHkuHhmDpYUH19+eRvrImt7sB6Q0
+J<>þU(d.…P¥U¾•ÂOÃ9*<2A>.qÿåÁjçŠo=Ô©<C394>2©øBÎŽI6ܹ»»Ë">òÁ&š-<2D>~>üýUÂÙ$<1F>ü<EFBFBD>D˜=<3D>!¾Œ

dot_zshrc.tmpl

@@ -4,19 +4,6 @@
 #  Sync source: https://git.melonbread.xyz/rain/gnu-plus-dotfiles
 # =============================================================================
 
-# ---------------------------------------------------------------------------
-# PATH (auto-deduplicated)
-# ---------------------------------------------------------------------------
-typeset -U path
-path=(
-    {{- if not (not (stat "/opt/rocm/bin")) }}
-    /opt/rocm/bin                      # ROCm tools first (rocminfo, rocm-smi, amd-smi, hipcc, etc.)
-    {{- end }}
-    $HOME/.local/bin
-    $HOME/.bin
-    $path
-)
-
 # ---------------------------------------------------------------------------
 # Oh My Zsh
 # ---------------------------------------------------------------------------
@@ -38,7 +25,7 @@ plugins=(
     fzf-tab                       # navigable Tab completion menu
     zsh-syntax-highlighting       # fish-style live colors — MUST be near last
     zsh-history-substring-search  # fish-style Up/Down history search
-    deja                          # predictive ghost completions — MUST be last (replaces zsh-autosuggestions)
+    zsh-autosuggestions           # fish-style ghost completions — MUST be last
 )
 
 
@@ -98,6 +85,18 @@ export TMUX_PLUGIN_MANAGER_PATH=~/.tmux/plugins/tpm
 # Debian: ROCm only relevant if you install it. Leave default until needed.
 {{ end -}}
 
+# ---------------------------------------------------------------------------
+# PATH (auto-deduplicated)
+# ---------------------------------------------------------------------------
+typeset -U path
+path=(
+    {{- if not (not (stat "/opt/rocm/bin")) }}
+    /opt/rocm/bin                      # ROCm tools first (rocminfo, rocm-smi, amd-smi, hipcc, etc.)
+    {{- end }}
+    $HOME/.local/bin
+    $HOME/.bin
+    $path
+)
 
 # ---------------------------------------------------------------------------
 # Aliases — common + OS-specific

run_once_20-install-user-packages-gentoo.sh.tmpl

@@ -239,13 +239,12 @@ else
     log "oh-my-zsh already installed"
 fi
 
-# Plugins: zsh-autosuggestions, zsh-syntax-highlighting, zsh-history-substring-search, fzf-tab, deja
+# Plugins: zsh-autosuggestions, zsh-syntax-highlighting, zsh-history-substring-search, fzf-tab
 declare -A PLUGINS=(
     [zsh-autosuggestions]="https://github.com/zsh-users/zsh-autosuggestions"
     [zsh-syntax-highlighting]="https://github.com/zsh-users/zsh-syntax-highlighting"
     [zsh-history-substring-search]="https://github.com/zsh-users/zsh-history-substring-search"
     [fzf-tab]="https://github.com/Aloxaf/fzf-tab"
-    [deja]="https://github.com/Giammarco-Ferranti/deja"
 )
 for plugin in "${!PLUGINS[@]}"; do
     if [[ -d "$ZSH_CUSTOM/plugins/$plugin" ]]; then
@@ -256,21 +255,6 @@ for plugin in "${!PLUGINS[@]}"; do
     fi
 done
 
-# deja predictive autosuggestions: binary via official installer (into
-# ~/.local/bin), then seed DB from history. SHELL neutralized so the
-# installer never touches .zshrc — the plugin above handles activation.
-if ! command -v deja >/dev/null 2>&1; then
-    log "installing deja binary via official installer"
-    curl -fsSL https://raw.githubusercontent.com/Giammarco-Ferranti/deja/main/install.sh \
-        | INSTALL_DIR="$USER_HOME/.local/bin" SHELL=/bin/sh sh \
-        || log "WARNING: deja install failed; retry manually."
-fi
-if command -v deja >/dev/null 2>&1 && [[ ! -s "$USER_HOME/.local/share/deja/deja.db" ]]; then
-    log "seeding deja DB from shell history"
-    HISTFILE="${HISTFILE:-$USER_HOME/.zsh_history}" deja import \
-        || log "WARNING: deja import failed; run 'deja import' later."
-fi
-
 # Step 8: tpm (tmux plugin manager)
 if [[ ! -d "$USER_HOME/.tmux/plugins/tpm" ]]; then
     log "installing tpm"

run_once_20-install-user-packages.sh.tmpl

@@ -6,8 +6,7 @@
 #  starship, lazygit, yt-dlp, etc.)
 #
 #  Also: install oh-my-zsh, zsh-autosuggestions, zsh-syntax-highlighting,
-#  zsh-history-substring-search, fzf-tab, and the deja autosuggestion engine
+#  zsh-history-substring-search, fzf-tab.
-#  (binary via official installer + plugin clone).
 #
 #  Runs as the unprivileged user, but uses sudo for system packages.
 #
@@ -278,30 +277,6 @@ install_zsh_plugin zsh-users/zsh-syntax-highlighting    "$ZSH_CUSTOM/plugins/zsh
 install_zsh_plugin zsh-users/zsh-history-substring-search "$ZSH_CUSTOM/plugins/zsh-history-substring-search"
 install_zsh_plugin Aloxaf/fzf-tab                       "$ZSH_CUSTOM/plugins/fzf-tab"
 
-install_zsh_plugin Giammarco-Ferranti/deja              "$ZSH_CUSTOM/plugins/deja"
-# --------------------------- deja (predictive autosuggestions) -------------
-# Binary via the official installer (checksum-verified release tarball into
-# ~/.local/bin). SHELL is neutralized so the installer never appends its
-# activation block to .zshrc — the OMZ plugin cloned above handles that.
-# `deja import` seeds the suggestion DB from $HISTFILE (falls back to
-# ~/.zsh_history); safe to re-run, it dedupes.
-if command -v deja >/dev/null 2>&1; then
-    log "deja already installed: $(deja --version 2>/dev/null | head -1)"
-else
-    log "installing deja binary via official installer"
-    if curl -fsSL https://raw.githubusercontent.com/Giammarco-Ferranti/deja/main/install.sh \
-        | INSTALL_DIR="$USER_HOME/.local/bin" SHELL=/bin/sh sh; then
-        log "deja installed"
-    else
-        log "WARNING: deja install failed; zsh-autosuggestions behavior will be absent. Retry manually."
-    fi
-fi
-if command -v deja >/dev/null 2>&1 && [[ ! -s "$USER_HOME/.local/share/deja/deja.db" ]]; then
-    log "seeding deja DB from shell history"
-    HISTFILE="${HISTFILE:-$USER_HOME/.zsh_history}" deja import \
-        || log "WARNING: deja import failed; run 'deja import' in an interactive shell later."
-fi
-
 # --------------------------- TPM (tmux plugin manager) ---------------------
 if [[ ! -d "$USER_HOME/.tmux/plugins/tpm" ]]; then
     log "cloning tmux plugin manager"